PT-2015-3516 · Ge Healthcare+2 · Ge Healthcare Centricity Analytics Server+2

Scott Erven · Published 2015-08-04 · Updated 2018-03-28 · CVE-2011-5322

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Healthcare Centricity Analytics Server version 1.1

Description The issue concerns default passwords for various users in the GE Healthcare Centricity Analytics Server. Specifically, the default passwords are: V0yag3r for the SQL Server sa user, G3car3s for the analyst user, G3car3s for the ccg user, V0yag3r for the viewer user, and geservice for the geservice user in the Webmin interface. The impact and attack vectors of this issue are not specified.

Recommendations For GE Healthcare Centricity Analytics Server version 1.1, change the default passwords for all users, including the SQL Server sa user, analyst user, ccg user, viewer user, and geservice user in the Webmin interface, to strong, unique passwords to prevent unauthorized access.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2011-5322

Affected Products

Ge Healthcare Centricity Analytics Server

Sql Server

Webmin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2011-5322 · Security Note
• http://forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts · Note
• https://twitter.com/digitalbond/status/619250429751222277 · Note
• http://apps.gehealthcare.com/servlet/ClientServlet/CA11_IN_2059103-001r4.pdf?REQ=RAA&DIRECTION=2059103-001&FILENAME=CA11_IN_2059103-001r4.pdf&FILEREV=4&DOCREV_ORG=4 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02 · Note