PT-2015-3460 · Ge Healthcare · Ge Healthcare Centricity Image Vault

Published 2015-08-04 · Updated 2018-03-28 · CVE-2004-2777

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Healthcare Centricity Image Vault versions 3.x

Description The issue concerns hardcoded or default passwords for various accounts in the system. Specifically, the passwords are: gemnet for the administrator account, webadmin for the webadmin administrator account of the ASACA DVD library, an empty value for the gemsservice account of the Ultrasound Database, and possibly gemnet2002 for the gemnet2002 account of the GEMNet license server. The impact and attack vectors of this issue are not clearly specified.

Recommendations For GE Healthcare Centricity Image Vault version 3.x, change the default passwords for all accounts, including the administrator, webadmin, gemsservice, and gemnet2002 accounts, to unique and secure values to prevent unauthorized access. Consider disabling or restricting access to these accounts until secure passwords are implemented.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2004-2777

Affected Products

Ge Healthcare Centricity Image Vault

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2004-2777 · Security Note
• http://forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts · Note
• https://twitter.com/digitalbond/status/619250429751222277 · Note
• http://apps.gehealthcare.com/servlet/ClientServlet/2010564-002E.pdf?REQ=RAA&DIRECTION=2010564-002&FILENAME=2010564-002E.pdf&FILEREV=E&DOCREV_ORG=E · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02 · Note