Vulnerability

GE Healthcare imaging and ultrasound systems expose default service credentials

MedDevice Cyber Staff · Dec 8 · 3 min read · Via CISA ICSMA-20-343-01

CISA published advisory ICSMA-20-343-01 on December 8, 2020, covering two vulnerabilities across GE Healthcare imaging and ultrasound products. Both carry a CVSS v3 score of 9.8. Lior Bar Yosef and Elad Luz of CyberMDX reported them.

CVE-2020-25179 (CWE-497) means exposed or default credentials can be used to access or modify sensitive information. CVE-2020-25175 (CWE-523, Unprotected Transport of Credentials) means specific credentials may be exposed in transit over the network. Both vectors are network, low complexity, no privileges and no user interaction.

The product list is long. It spans LightSpeed, BrightSpeed, Discovery CT and Optima CT scanners, Signa and Brivo MR systems, Definium, Discovery XR and Brivo XR radiography, Discovery NM and Infinia nuclear medicine cameras, Innova interventional systems, AW and AWS workstations, and LOGIQ, EchoPAC and Image Vault ultrasound software.

The attacker first needs a foothold on the healthcare delivery organization's network. From there, access is comparable to GE's own remote service user privileges, which can expose a limited set of PHI or run arbitrary code that affects availability and allows manipulation of PHI.

GE says it has mitigations for specific products and releases and will proactively configure product firewall protection and change default passwords on impacted devices where possible. Details sit on the GE Healthcare Product Security Portal. A service account that is the same on every scanner in the fleet is a fleet-wide key, and the fix has to reach each box.

Are you a representative of GE HealthCare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no single patch: GE Healthcare is changing default passwords and configuring product firewalls on impacted devices where possible, with product-specific mitigations on its Product Security Portal. Sites should confirm which of their scanners and workstations GE has reached. Keep the systems on segmented clinical networks, since exploitation starts with access to the hospital network.

Match the fleet to the product list. Identify every affected CT, MR, X-ray, nuclear medicine, interventional and ultrasound system on site.
Confirm GE's password and firewall changes. Work with GE service to verify default passwords are changed and product firewalls configured on each device.
Segment the imaging network. Exploitation first needs a foothold on the hospital network, so limit what can reach these systems.
Retire shared service accounts. Manufacturers should issue unique service credentials per device and send them only over encrypted channels.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

User accounts

Contributing

Remote access Handles patient data Hospital network

CT scanners

Handles patient data Remote access

MR systems

Handles patient data Remote access

X-ray systems

Handles patient data

Nuclear medicine systems

Handles patient data

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
EchoPAC Software Only, EchoPAC Plug-in	GE HealthCare	Names the affected product	No feedback feed from manufacturer
DRX - Compass	Carestream Health	Same FDA device type	No feedback feed from manufacturer
MAGNETOM Vida	Siemens Healthineers	Same FDA device type	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Confirm Rx Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
eCARTv5 Clinical Deterioration Suite	AgileMD	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Homechoice Claria APD System	Baxter	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
BodyGuardian Remote Monitoring System	Boston Scientific	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
TheraSphere 360 Y-90 Management Platform	Boston Scientific	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
CoroFlow Cardiovascular System	Coroventis Research	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-411	No feedback feed from manufacturer

25 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What are CVE-2020-25179 and CVE-2020-25175 in GE Healthcare imaging systems?

CVE-2020-25179 lets exposed or default credentials be used to access or modify sensitive information, and CVE-2020-25175 exposes specific credentials during network transport. Both score CVSS 9.8 and affect GE Healthcare CT, MR, X-ray, nuclear medicine, interventional and ultrasound products, per CISA advisory ICSMA-20-343-01 of December 8, 2020.

How is GE Healthcare mitigating the default credential flaws in ICSMA-20-343-01?

GE Healthcare will proactively configure product firewall protection and change default passwords on impacted devices where possible, and lists product-specific mitigations on its Product Security Portal, per CISA advisory ICSMA-20-343-01. GE also recommends clinical network security best practices.

Who found the GE Healthcare imaging default credential vulnerabilities?

Lior Bar Yosef and Elad Luz of CyberMDX reported CVE-2020-25179 and CVE-2020-25175 in GE Healthcare imaging and ultrasound products, covered by CISA advisory ICSMA-20-343-01 on December 8, 2020.

← Back to Vulnerabilities