PT-2015-3590 · Netopia+1 · Timbuktu Pro+1

Scott Erven · Published 2015-08-04 · Updated 2018-03-28 · CVE-2013-7442

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GE Healthcare Centricity PACS Workstation versions 4.0 through 4.0.1

Description The issue concerns hardcoded passwords for the Administrator and IIS users. The passwords are CANal1 for the Administrator user and iis for the IIS user. This has unspecified impact and is related to TimbuktuPro, with unclear details on whether these passwords are default, hardcoded, or dependent on another system.

Recommendations For GE Healthcare Centricity PACS Workstation versions 4.0 through 4.0.1, change the default passwords for the Administrator and IIS users to strong, unique passwords to mitigate potential risks. As a temporary workaround, consider restricting access to the system until the passwords can be changed.

Fix

Weakness Enumeration

CWE-255

Related Identifiers

CVE-2013-7442

Affected Products

Ge Healthcare Centricity Pacs Workstation

Timbuktu Pro

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2013-7442 · Security Note
• http://forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts · Note
• http://apps.gehealthcare.com/servlet/ClientServlet/C40_WS_INST_SV_2063534-001r2.pdf?REQ=RAA&DIRECTION=2063534-001&FILENAME=C40_WS_INST_SV_2063534-001r2.pdf&FILEREV=1&DOCREV_ORG=1 · Note
• https://twitter.com/digitalbond/status/619250429751222277 · Note
• http://apps.gehealthcare.com/servlet/ClientServlet/C401_WS_INST_SV_2069560001r1.pdf?REQ=RAA&DIRECTION=2069560-001&FILENAME=C401_WS_INST_SV_2069560001r1.pdf&FILEREV=1&DOCREV_ORG=1 · Note
• https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02 · Note