CVE-2024-1629: Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component

Severity: medium (CVSS 6.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-22

Description

Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component

Affected products

GE HealthCare LOGIQ e: from R7 through R9.1.4; from R8 through R10.1.3; from R9 through R11.0.3
GE HealthCare LOGIQ E10: before R3.2.0 — fixed in R3.2.0
GE HealthCare LOGIQ E10s: before R3.2.0 — fixed in R3.2.0
GE HealthCare LOGIQ Fortis: before R3.2.0 — fixed in R3.2.0
GE HealthCare LOGIQ He: through R9.3.1
GE HealthCare Venue: from R3 through R3.3; from R4 through R4.3; R1, R2
GE HealthCare Venue Fit: from R3 through R3.3; from R4 through R4.3
GE HealthCare Venue Go: from R3 through R3.3; from R4 through R4.3; R2
GE HealthCare Vivid E: from E95 before 206; from E90 before 206; from E80 before 206 — fixed in 206
GE HealthCare Vivid iq: before 206 — fixed in 206
GE HealthCare Vivid S: from 70N before 206; from 60N before 206 — fixed in 206
GE HealthCare Vivid T: from T8 before 206; from T9 before 206 — fixed in 206
GE HealthCare Voluson Expert 16: 0, BT24
GE HealthCare Voluson Expert 18: 0, BT24
GE HealthCare Voluson Expert 22: 0, BT24
GE HealthCare Voluson SWIFT: 0, BT24

How to fix

Upgrade to a fixed version: GE HealthCare LOGIQ E10 R3.2.0; GE HealthCare LOGIQ E10s R3.2.0; GE HealthCare LOGIQ Fortis R3.2.0; GE HealthCare Vivid E 206; GE HealthCare Vivid iq 206; GE HealthCare Vivid S 206; GE HealthCare Vivid T 206. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1629 or the next vulnerability affects your stack