CVE-2024-1486: Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Severity: high (CVSS 7.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-732

Description

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Affected products

Gehealthcare Invenia Abus 2.0 Firmware: before 2.2.9 — fixed in 2.2.9
Gehealthcare Invenia Abus Firmware: 1.2.3
Gehealthcare Logiq E Firmware: from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.2
Gehealthcare Logiq He Firmware: through R9.3.1
Gehealthcare Venue Firmware: from R3 through R3.3; from R4 through R4.2; R1, R2
Gehealthcare Venue Fit Firmware: from R3 through R3.3; from R4 through R4.2
Gehealthcare Venue Go Firmware: from R3 through R3.3; from R4 through R4.2; R2
Gehealthcare Vivid E Firmware: from E95 before 206; from E90 before 206; from E80 before 206; from E9 113.2 through 113.2 — fixed in 206
Gehealthcare Vivid Iq Firmware: before 206 — fixed in 206
Gehealthcare Vivid S Firmware: from 70N before 206; from 60N before 206 — fixed in 206
Gehealthcare Vivid T Firmware: from T8 before 206; from T9 before 206 — fixed in 206

How to fix

Upgrade to a fixed version: Gehealthcare Invenia Abus 2.0 Firmware 2.2.9; Gehealthcare Vivid E Firmware 206; Gehealthcare Vivid Iq Firmware 206; Gehealthcare Vivid S Firmware 206; Gehealthcare Vivid T Firmware 206. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1486 or the next vulnerability affects your stack