Silex modules in GE MobileLink allow unauthenticated setting changes and command injection
CISA advisory ICSMA-18-128-01 covers missing authentication (CVE-2018-6020, CVSS v3 6.5) and OS command injection (CVE-2018-6021, CVSS v3 7.4) in Silex Technology SX-500 and SD-320AN modules integrated into GE Healthcare MobileLink. Firmware 1.14 fixes the GEH-SD-320AN; the SX-500 needs its update account enabled.