PT-2015-3460 · Ge Healthcare · Ge Healthcare Centricity Image Vault

Publicado 2015-08-04 · Atualizado 2018-03-28 · CVE-2004-2777

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Healthcare Centricity Image Vault versions 3.x

Description The issue concerns hardcoded or default passwords for various accounts in the system. Specifically, the passwords are: gemnet for the administrator account, webadmin for the webadmin administrator account of the ASACA DVD library, an empty value for the gemsservice account of the Ultrasound Database, and possibly gemnet2002 for the gemnet2002 account of the GEMNet license server. The impact and attack vectors of this issue are not clearly specified.

Recommendations For GE Healthcare Centricity Image Vault version 3.x, change the default passwords for all accounts, including the administrator, webadmin, gemsservice, and gemnet2002 accounts, to unique and secure values to prevent unauthorized access. Consider disabling or restricting access to these accounts until secure passwords are implemented.

Correção

Enumeração de Fraquezas

CWE-255

Identificadores relacionados

CVE-2004-2777

Produtos afetados

Ge Healthcare Centricity Image Vault

Referências · 5

• http://forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts · Nota
• https://twitter.com/digitalbond/status/619250429751222277 · Nota
• http://apps.gehealthcare.com/servlet/ClientServlet/2010564-002E.pdf?REQ=RAA&DIRECTION=2010564-002&FILENAME=2010564-002E.pdf&FILEREV=E&DOCREV_ORG=E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2004-2777 · Nota de Segurança
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02 · Nota