{"id":"CVE-2024-1628","state":"PUBLISHED","title":"OS command injection vulnerabilities in GE HealthCare ultrasound devices","description":"OS command injection vulnerabilities in GE HealthCare ultrasound devices","publishedAt":"2024-05-14T16:04:57.780Z","updatedAt":"2024-08-01T18:48:21.580Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"GEHC"},"assigner":"GEHC","products":["GE HealthCare Venue","GE HealthCare Venue Go","GE HealthCare Venue Fit","GE HealthCare LOGIQ e","GE HealthCare LOGIQ He","GE HealthCare Vivid E","GE HealthCare Vivid S","GE HealthCare Vivid T","GE HealthCare Vivid iq","GE HealthCare Voluson Expert 16","GE HealthCare Voluson Expert 18","GE HealthCare Voluson Expert 22","GE HealthCare Voluson SWIFT","GE HealthCare Invenia ABUS 2.0","GE HealthCare LOGIQ E10","GE HealthCare LOGIQ E10s","GE HealthCare LOGIQ Fortis"],"affected":[{"vendor":"GE HealthCare","product":"Venue","defaultStatus":"unaffected","versions":[{"version":"R1","status":"affected"},{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Go","defaultStatus":"unaffected","versions":[{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Fit","defaultStatus":"unaffected","versions":[{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ e","defaultStatus":"unaffected","versions":[{"version":"R7","status":"affected","lessThanOrEqual":"R9.1.4","versionType":"custom"},{"version":"R8","status":"affected","lessThanOrEqual":"R10.1.3","versionType":"custom"},{"version":"R9","status":"affected","lessThanOrEqual":"R11.0.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ He","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"R9.3.1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid E","defaultStatus":"unaffected","versions":[{"version":"E95","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E90","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E80","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid S","defaultStatus":"unaffected","versions":[{"version":"70N","status":"affected","lessThan":"206","versionType":"custom"},{"version":"60N","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid T","defaultStatus":"unaffected","versions":[{"version":"T8","status":"affected","lessThan":"206","versionType":"custom"},{"version":"T9","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid iq","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 16","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected","lessThan":"Ext1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 18","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected","lessThan":"Ext1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 22","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected","lessThan":"Ext1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson SWIFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Invenia ABUS 2.0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.2.7","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ Fortis","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]}],"references":["https://securityupdate.gehealthcare.com/"],"weaknesses":["CWE-78"],"ingestedAt":"2026-10-29T20:06:59.846Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2024/1xxx/CVE-2024-1628.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.1","cveMetadata":{"cveId":"CVE-2024-1628","state":"PUBLISHED","datePublished":"2024-05-14T16:04:57.780Z","dateUpdated":"2024-08-01T18:48:21.580Z","assignerShortName":"GEHC","assignerOrgId":"171caf72-b841-4e04-a68e-93493aff2b94","dateReserved":"2024-02-19T15:23:20.113Z"},"containers":{"cna":{"title":"OS command injection vulnerabilities in GE HealthCare ultrasound devices","descriptions":[{"lang":"en","value":"OS command injection vulnerabilities in GE HealthCare ultrasound devices"}],"affected":[{"vendor":"GE HealthCare","product":"Venue","defaultStatus":"unaffected","versions":[{"version":"R1","status":"affected"},{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Go","defaultStatus":"unaffected","versions":[{"version":"R2","status":"affected"},{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Venue Fit","defaultStatus":"unaffected","versions":[{"version":"R3","status":"affected","lessThanOrEqual":"R3.3","versionType":"custom"},{"version":"R4","status":"affected","lessThanOrEqual":"R4.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ e","defaultStatus":"unaffected","versions":[{"version":"R7","status":"affected","lessThanOrEqual":"R9.1.4","versionType":"custom"},{"version":"R8","status":"affected","lessThanOrEqual":"R10.1.3","versionType":"custom"},{"version":"R9","status":"affected","lessThanOrEqual":"R11.0.3","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ He","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"R9.3.1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid E","defaultStatus":"unaffected","versions":[{"version":"E95","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E90","status":"affected","lessThan":"206","versionType":"custom"},{"version":"E80","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid S","defaultStatus":"unaffected","versions":[{"version":"70N","status":"affected","lessThan":"206","versionType":"custom"},{"version":"60N","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid T","defaultStatus":"unaffected","versions":[{"version":"T8","status":"affected","lessThan":"206","versionType":"custom"},{"version":"T9","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Vivid iq","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"206","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 16","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected","lessThan":"Ext1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 18","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected","lessThan":"Ext1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson Expert 22","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected","lessThan":"Ext1","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"Voluson SWIFT","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected"},{"version":"BT24","status":"affected"}]},{"vendor":"GE HealthCare","product":"Invenia ABUS 2.0","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThanOrEqual":"2.2.7","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ E10s","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]},{"vendor":"GE HealthCare","product":"LOGIQ Fortis","defaultStatus":"unaffected","versions":[{"version":"0","status":"affected","lessThan":"R3.2.0","versionType":"custom"}]}],"references":[{"url":"https://securityupdate.gehealthcare.com/"}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"LOCAL","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-78","description":"CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"GEHC","orgId":"171caf72-b841-4e04-a68e-93493aff2b94","dateUpdated":"2024-05-14T16:04:57.780Z"},"credits":[{"lang":"en","type":"finder","value":"Andrea Palanca and Gabriele Quagliarella of Nozomi Networks"}],"impacts":[{"capecId":"CAPEC-6","descriptions":[{"lang":"en","value":"CAPEC-6 Argument Injection"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.1.0-dev"}},"adp":[{"title":"CISA ADP Vulnrichment","affected":[{"vendor":"ge_healthcare","product":"venue","defaultStatus":"unknown","versions":[{"version":"multiple versions","status":"affected"}],"cpes":["cpe:2.3:a:ge_healthcare:venue:*:*:*:*:*:*:*:*"]},{"vendor":"ge_healthcare","product":"vivid","defaultStatus":"unknown","versions":[{"version":"multiple versions","status":"affected"}],"cpes":["cpe:2.3:a:ge_healthcare:vivid:*:*:*:*:*:*:*:*"]},{"vendor":"ge_healthcare","product":"voluson","defaultStatus":"unknown","versions":[{"version":"multiple versions","status":"affected"}],"cpes":["cpe:2.3:a:ge_healthcare:voluson:*:*:*:*:*:*:*:*"]},{"vendor":"ge_healthcare","product":"logiq","defaultStatus":"unknown","versions":[{"version":"multiple versions","status":"affected"}],"cpes":["cpe:2.3:a:ge_healthcare:logiq:*:*:*:*:*:*:*:*"]}],"metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2024-1628","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2024-05-16T16:10:00.517201Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2024-06-04T18:01:30.939Z"}},{"title":"CVE Program Container","references":[{"url":"https://securityupdate.gehealthcare.com/","tags":["x_transferred"]}],"providerMetadata":{"shortName":"CVE","orgId":"af854a3a-2127-422b-91ae-364da2661108","dateUpdated":"2024-08-01T18:48:21.580Z"}}]}}}