CVE-2024-1630: Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component

Severity: high (CVSS 7.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-05-14 · updated 2026-06-17
Weakness: CWE-22

Description

Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component

Affected products

Gehealthcare Logiq E10: before r3.2.0 — fixed in r3.2.0
Gehealthcare Logiq E10S: before r3.2.0 — fixed in r3.2.0
Gehealthcare Logiq E Firmware: from r7 through r9.1.4; from r8 through r10.1.3; from r9 through r11.0.3
Gehealthcare Logiq Fortis: before r3.2.0 — fixed in r3.2.0
Gehealthcare Logiq He Firmware: through r9.3.1
Gehealthcare Venue Firmware: from r3 through r3.3; from r4 through r4.3; r1, r2
Gehealthcare Venue Fit Firmware: from r3 through r3.3; from r4 through r4.3
Gehealthcare Venue Go Firmware: from r3 through r3.3; from r4 through r4.3; r2
Gehealthcare Vivid E Firmware: from e95 before 206; from e90 before 206; from e80 before 206 — fixed in 206
Gehealthcare Vivid Iq Firmware: before 206 — fixed in 206
Gehealthcare Vivid T Firmware: from t8 before 206; from t9 before 206 — fixed in 206
Gehealthcare Voluson Expert 16: 0, bt24
Gehealthcare Voluson Expert 18: 0, bt24
Gehealthcare Voluson Expert 22: 0, bt24
Gehealthcare Voluson Swift: 0, bt24

How to fix

Upgrade to a fixed version: Gehealthcare Logiq E10 r3.2.0; Gehealthcare Logiq E10S r3.2.0; Gehealthcare Logiq Fortis r3.2.0; Gehealthcare Vivid E Firmware 206; Gehealthcare Vivid Iq Firmware 206; Gehealthcare Vivid T Firmware 206. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-1630 or the next vulnerability affects your stack