PT-2015-3456 · Tightvnc+2 · Winvnc+3

Published 2015-08-04 · Updated 2018-03-28 · CVE-2001-1594

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Healthcare eNTEGRA P&R (affected versions not specified)

Description The issue concerns hardcoded or default passwords for various user accounts in the GE Healthcare eNTEGRA P&R system. The affected accounts include the entegra user with password entegra, the super user of the Polestar/Polestar-i Starlink 4 upgrade with password passme, the entegra user of the Codonics printer FTP service with password 0, the eNTEGRA P&R user account with password eNTEGRA, and the WinVNC Login with password insite. The impact and attack vectors of this issue are not clearly specified.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2001-1594

Affected Products

Codonics Printer

Ge Healthcare Entegra P&R

Polestar

Winvnc

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2001-1594 · Security Note
• http://forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts · Note
• https://twitter.com/digitalbond/status/619250429751222277 · Note
• http://apps.gehealthcare.com/servlet/ClientServlet/2263784.pdf?DOCCLASS=A&REQ=RAC&DIRECTION=2263784-100&FILENAME=2263784.pdf&FILEREV=5&DOCREV_ORG=5&SUBMIT=+ACCEPT+ · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02 · Note