A security flaw in the server behind GE Revolution CT scanners

MedDevice Cyber Staff · May 11 · 2 min read · Via Radiology Business

GE HealthCare recalled certain Revolution CT systems, the Apex, Ascend and CT lines, over a vulnerability in the AW Server deployed through the Edison Health Link CT Smart Subscription. About 200 systems worldwide, an FDA Class 2 recall, no breaches reported. Customers can keep using the systems while following cybersecurity best practices, which matters because a CT scanner is not a device a hospital takes offline to wait for a fix.

Handling a software weakness through a device recall while the equipment stays in clinical use reflects how postmarket safety oversight now treats connected systems. A recall in this sense is a formal notice and corrective action, not necessarily a removal from service, and telling operators they may continue while following cybersecurity best practices signals a risk judged manageable with controls while a correction is prepared.

The affected piece is the connected-services layer, the AW Server reached through a cloud subscription. Every service you bolt onto a device to make it smarter is a new thing to secure. The subscription that ships analytics also ships a network path into the imaging chain.

The affected element is a server reached over a subscription rather than the imaging hardware itself, which is characteristic of how diagnostic equipment is now built out. Analytics, storage and remote support arrive as networked services layered onto the scanner, and each layer enlarges the software that must be maintained and defended across the machine's long service life.

For a hospital the practical worry is continuity as much as confidentiality. A computed tomography service anchors emergency and inpatient diagnosis, and disruption reaching the connected layer could interfere with how studies are routed, processed or retrieved even when the scan itself proceeds. Diagnostic imaging that cannot be reached or trusted on demand slows every clinical decision that waits on it.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

GE HealthCare recalled certain Revolution CT systems over a flaw in the AW Server delivered through Edison Health Link, about 200 systems worldwide with no breaches reported. Apply the corrective action GE provides and confirm the AW Server component is on the remediated version.

Follow the recall correction. Apply GE HealthCare's field correction for the affected Revolution CT and AW Server configuration.
Confirm the server component version. The flaw was in the server behind the scanner, so verify that piece specifically, not just the console.
Segment imaging servers. Keep subscription-delivered server components on a controlled segment so a server-side flaw is not reachable broadly.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

net_cloud net_remote_access sys_ots_software sys_firmware_update use_hospital_net data_phi app_database net_wired

EMB3D

PID-26 PID-41

Fix the class in your product

The flaw is in the OS inside the controller, or a system past end of service still in the field. As the maker, own the embedded OS and server lifecycle as a safety obligation, design controllers to update in the field, and make every fault degrade to a defined safe state.

Own the OS lifecycle. Patch the OS and server components on a schedule with a tested delivery path.
Design for field update. And for planned replacement, so an unpatchable unit has a path off the network.
Degrade to safe. A fault drives a defined safe state, never an unexpected stop on a life-sustaining device.

Mapped EMB3D mitigations

Questions & Answers

Why were GE Revolution CT systems recalled?

A vulnerability in the AW Server deployed through the Edison Health Link CT Smart Subscription, affecting about 200 systems worldwide across the Apex, Ascend and CT lines. FDA classified it Class 2, and no breaches were reported.

Can hospitals keep using the affected CT scanners?

Yes, while following cybersecurity best practices. The affected piece is the connected services layer rather than the scanner itself, and every subscription service bolted onto a device is a new network path to secure.

← Back to Vulnerabilities