Vulnerability

GE Healthcare ultrasound systems let a local user escape Kiosk Mode to the operating system

MedDevice Cyber Staff · Feb 18 · 3 min read · Via CISA ICSMA-20-049-02

CISA published advisory ICSMA-20-049-02 on February 18, 2020, for a restricted desktop escape in GE Healthcare ultrasound products. CVE-2020-6977 (CWE-693, protection mechanism failure) carries a CVSS v3.1 base score of 8.4. Researchers credited in the advisory include Marc Ruef and Rocco Gagliardi of scip AG, Michael Aguilar of Secureworks and Jonathan Bouman of Protozoan.nl.

Six GE ultrasound lines are affected: Invenia ABUS Scan station (not the VScan line), LOGIQ (except LOGIQ 100 Pro), Venue (except Venue 40 R1-3 and Venue 50 R4-5), Versana Essential, Vivid (except EchoPAC) and Voluson (except ImageVault). All versions are listed.

The flaw is in Kiosk Mode, the locked-down shell that keeps sonographers inside the ultrasound application. Specially crafted inputs at the console break out of it and land the user on the underlying operating system. The vector is local, with no privileges or user interaction required, and full confidentiality, integrity and availability impact.

GE's mitigations are physical. Restrict physical access to the devices, and where available turn on the system lock password in the Administration GUI menu, which requires a password before anyone can use the system. Questions go to a GE Healthcare service representative or the GE product security portal.

Ultrasound carts sit in exam rooms and corridors where patients and visitors pass. A kiosk shell is a usability feature that should never be counted as the access control.

Are you a representative of GE HealthCare? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

GE did not list a software fix for CVE-2020-6977. Enable the system lock password in the Administration GUI on every affected LOGIQ, Vivid, Voluson, Venue, Versana Essential and Invenia ABUS system where the option exists, and keep the carts in controlled areas. Check with GE service for model-specific guidance.

Turn on system lock. Enable the system lock password in the Administration GUI menu so the system needs a password before use.
Restrict physical access. Keep ultrasound systems in staffed or locked rooms when idle.
Inventory affected lines. Map each unit to the advisory's product list and exclusions, such as LOGIQ 100 Pro and EchoPAC.
Do not treat kiosk shells as security. Device makers should enforce OS-level user accounts behind any kiosk application.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

LOGIQ

Vivid

Voluson

Venue

Versana Essential

Invenia ABUS Scan station

PID-23

Fix the class in your product

A standard user on the workstation becomes SYSTEM, or the client hands over stored credentials. As the maker, load libraries only from fixed trusted paths, hold short-lived tokens instead of recoverable credentials, and remove user-writable directories from any privileged search path.

Pin library load paths. Restrict the search path and load by full absolute path, never from a working directory.
Hold tokens, not passwords. Keep a short-lived token in the OS vault; store nothing reusable at rest.
Set installer ACLs. No privileged binary loads from a location a standard user can write.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
EchoPAC Software Only, EchoPAC Plug-in	GE HealthCare	Names the affected product	No feedback feed from manufacturer
Assert-IQ Insertable Cardiac Monitor	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
SafeOp 2: Neural Informatix System	Alphatec Spine	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
LabPro Data Management System	Beckman Coulter	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
iLab Polaris Multi-Modality Guidance System	Boston Scientific	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
DRX - Compass	Carestream Health	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Xpert C. difficile/Epi	Cepheid	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Stelo Glucose Biosensor System	DexCom	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Infinity Gateway Suite	Dräger	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Monaco RTP System	Elekta	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
AutoSeg	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Portrait Central Viewer Application (Portrait CV A01)	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
ViewPoint 6	GE HealthCare	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer
Brevera Biopsy System with CorLumina Imaging Technology	Hologic	Same property (MITRE EMB3D)PID-23	No feedback feed from manufacturer

16 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-6977 in GE Healthcare ultrasound systems?

CVE-2020-6977 is a Kiosk Mode escape (CWE-693, CVSS v3.1 8.4) in GE Healthcare LOGIQ, Vivid, Voluson, Venue, Versana Essential and Invenia ABUS ultrasound systems, disclosed in CISA advisory ICSMA-20-049-02 on February 18, 2020. Crafted inputs let a local user leave the restricted environment and reach the operating system.

How do I mitigate the GE ultrasound Kiosk Mode escape?

GE Healthcare recommends restricting physical access to affected ultrasound systems and enabling the system lock password in the Administration GUI menu where available, per CISA advisory ICSMA-20-049-02 on CVE-2020-6977.

← Back to Vulnerabilities