CVE-2017-14006CWE-287

GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials

published March 20, 2018

CVSS
—
EPSS
2%
Percentile
79.1
In the wild
Unconfirmed
What it is

⚠️ Default credentials strike again! The GE Xeleris medical imaging systems are vulnerable thanks to hard-coded passwords that let attackers bypass authentication like a hospital receptionist letting anyone into secure areas. 😱 Think of these medical devices as a clinic with a front desk that never verifies IDs. If a visitor can just walk in without any questions, it’s a recipe for disaster! An attacker could gain unauthorized access to sensitive imaging systems, potentially compromising patient data and system integrity. Imagine someone walking into an operating room and accessing vital medical information. Absolutely devastating!

Put simply

Think of these medical devices as a clinic with a front desk that never verifies IDs. If a visitor can just walk in without any questions, it’s a recipe for disaster! The vulnerability arises from the use of default or hard-coded credentials in GE Xeleris versions 1.0, 1.1, 2.1, 3.0, and 3.1, allowing remote attackers to bypass authentication easily.

What to do

An attacker could gain unauthorized access to sensitive imaging systems, potentially compromising patient data and system integrity. Imagine someone walking into an operating room and accessing vital medical information. Absolutely devastating! To secure your devices, change the default credentials immediately and ensure that all hard-coded passwords are updated. Regularly audit your systems and check for any updates from the vendor to enhance security. 🛡️ You've got this! With a few simple steps, you can lock things down and protect your sensitive data! 🚀

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01861 · 79.1th percentile
Weakness
CWE-287 · Improper Authentication
Published
2018-03-20T16:00Z
EPSS history
Timeline
  • 20 MAR 16:00Z
    GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials
    cvelistv5