Login credentials exposed on the workstation in a GE imaging viewer

MedDevice Cyber Staff · Mar 16 · 2 min read · Via FDA

GE HealthCare Centricity Universal Viewer drew an FDA Class 2 recall, event Z-1569-2026, covering roughly 1,568 units. A flaw exposes user login credentials on the local client workstation, and an attacker with physical access could harvest them.

Credential exposure on a local client is a quieter weakness than a remote exploit, and it recurs because clinical software is frequently built as though the workstation were a trusted, physically secured console. That assumption held when a dedicated operator sat at a dedicated machine. It weakens in a shared reading room where the same terminal passes between technologists, residents and attending physicians across a shift, any of whom, or anyone loitering near an unlocked screen, becomes a candidate to lift a stored login.

The danger is not that the viewer stops working but that a valid credential slips out unnoticed. A harvested login carries the privileges of the clinician it belongs to, and it can be reused against the same imaging systems without tripping the alarms a malformed request would raise. Access that looks authentic is the hardest kind to detect, because from the system's perspective nothing anomalous has occurred.

The response moved through the regulatory recall channel rather than a numbered vulnerability advisory, and the classification signals a correction rather than a withdrawal. Devices in that category are expected to keep running in the field while an interim measure holds, an arrangement that reflects how disruptive pulling an imaging viewer from service would be. Radiology cannot pause reads while a permanent fix is engineered, so the correction has to be something a site can apply without taking the console down.

GE issued an Urgent Medical Device Correction and recommended AD or LDAP network authentication as interim mitigation, which moves auth off the local client onto the directory. Keep secrets off the client, authenticate against a directory, and assume the workstation is a place people can walk up to. In a hospital reading room, they can.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

GE HealthCare issued an urgent correction for Centricity Universal Viewer after a flaw exposed user login credentials on the local client, logged by FDA as a Class 2 recall. Apply the correction and, since exploitation needs physical access, tighten workstation access control in the interim.

Apply the urgent correction. Install GE's fix for the credential-exposure flaw in Centricity Universal Viewer.
Lock down the workstations. The attack needs local access, so enforce screen locks, disk encryption, and physical controls on reading stations until patched.
Stop storing recoverable credentials on the client. Client software should hold short-lived tokens, not credentials an attacker with local access can harvest.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

app_user_accounts app_web_ui use_hospital_net net_remote_access data_phi app_roles

EMB3D

PID-2321 PID-23221

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Questions & Answers

Why was GE Centricity Universal Viewer recalled?

A flaw exposed user login credentials on the local client workstation, harvestable by anyone with physical access. FDA logged it as Class 2 recall event Z-1569-2026 covering roughly 1,568 units.

What is the interim mitigation for the Centricity viewer?

GE recommended AD or LDAP network authentication, which moves credential handling off the local client and onto the directory. In a hospital reading room, walking up to the workstation is a realistic threat.

← Back to Vulnerabilities