CISA published advisory ICSMA-18-037-02 on February 6, 2018, covering default or hard-coded credentials in more than 30 GE Healthcare products, credited to researcher Scott Erven. The advisory carries 21 CVEs under CWE-287, from CVE-2001-1594 to CVE-2017-14008, and each one scores 9.8 on CVSS v3.
The list spans CT, MR, X-ray and nuclear medicine systems plus the software around them: Optima CT and MR360, Discovery NM530c, NM750b, VH and XR656, the Millennium and Infinia lines, Xeleris workstations, Centricity PACS, DMS and Image Vault, CADstream and the GEMNet license server. Most versions are listed as all versions; Discovery NM530c below 1.003 and NM750b below 2.003 are the exceptions.
The individual CVE records read like a password file. The Optima CT systems carry a default root password. The Discovery NM 750b has a fixed password for the insite account over Telnet and FTP. On the Millennium MG, NC and MyoSIGHT, the insite password cannot be changed without disabling remote InSite support.
That last detail shows why these credentials persist. A service account shared across a fleet is convenient for remote support and costly to unwind, because changing it breaks the vendor's own access path.
GE has produced product updates, available on request, that replace default or hard-coded credentials with custom ones for all but three products. No update is available for the Optima 680, Revolution XQ/i and THUNIS-800+. Several CVE records note it is unclear whether a given password is default, hard-coded or required by another product.
Every one of these systems should get its credentials replaced or be walled off from everything except the hosts it serves.