Skip to content
Fencer Vulns
high 7.4

CVE-2024-1486 json

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

published 2024-05-14 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-17234

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 10%
public exploits
0
none known

Summary

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Patch / fix

  • GE HealthCare Vivid E 206
  • GE HealthCare Vivid S 206
  • GE HealthCare Vivid T 206
  • GE HealthCare Vivid iq 206
  • GE HealthCare Invenia ABUS 2.0 2.2.9
  • gehealthcare vivid_e_firmware 206
  • gehealthcare vivid_s_firmware 206
  • gehealthcare vivid_t_firmware 206
  • gehealthcare vivid_iq_firmware 206
  • gehealthcare invenia_abus_2.0_firmware 2.2.9

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-20-049-02 updated cvss 7.4

GE Healthcare Ultrasound products (Update A)

  • GE Healthcare Invenia ABUS Scan station, not including VScan product line GE Healthcare LOGIQ, not including LOGIQ 100 Pro GE Healthcare Venue, not including Venue 40 R1-3 and Venue 50 R4-5 GE Healthcare Versana Essential GE Healthcare Vivid products, not including EchoPAC GE Healthcare Voluson, not including ImageVault
    affected: mitigation securityupdate.gehealthcare.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 10% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • GE HealthCare Venue
  • GE HealthCare Venue Go
  • GE HealthCare Venue Fit
  • GE HealthCare LOGIQ e
  • GE HealthCare LOGIQ He
  • GE HealthCare Vivid E
  • GE HealthCare Vivid S
  • GE HealthCare Vivid T
  • GE HealthCare Vivid iq
  • GE HealthCare Invenia ABUS
  • GE HealthCare Invenia ABUS 2.0
  • gehealthcare venue_firmware
  • gehealthcare venue_go_firmware
  • gehealthcare venue_fit_firmware
  • gehealthcare logiq_e_firmware
  • gehealthcare logiq_he_firmware
  • gehealthcare vivid_e_firmware
  • gehealthcare vivid_s_firmware
  • gehealthcare vivid_t_firmware
  • gehealthcare vivid_iq_firmware
  • gehealthcare invenia_abus_firmware
  • gehealthcare invenia_abus_2.0_firmware

Classification

Weakness
  • CWE-732 Incorrect Permission Assignment for Critical Resource

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.