GE Healthcare MDHexRay Vulnerabilities
Two credential reuse vulnerabilities called MDHexRay have been detected in twenty four separate product families in GE Healthcare's imaging business. These could be exploited to obtain patient identifiable information.
Summary
Two credential reuse vulnerabilities called MDHexRay have been detected in twenty four separate product families in GE Healthcare's imaging business. These could be exploited to obtain patient identifiable information.
Affected platforms
The following platforms are known to be affected:
MDHexRay affects more than 20 product families across GE Healthcare's advanced visualisation, CT, interventional, mammography, MRI, PET, ultrasound, and x-ray modalities.
Threat details
Introduction
GE Healthcare has released details of two vulnerabilities, collectively named MDHexRay, affecting a wide range of their imaging and ultrasound products. They claim that an attacker on the same local network could exploit these vulnerabilities to obtain sensitive information, including patient data, or execute command on affected systems.
Vulnerability details
Both vulnerabilities are the result of default credential reuse in GE Healthcare's proprietary Unix-based operating system installed on the affected products.
The default credentials are used to remotely administer and maintain GE Healthcare products, and were freely available through GE Healthcare's customer portal. Any user with prior access to these would be able to log in to an affected products and alter system settings or expose data in transit
Remediation advice
GE Healthcare have confirmed they are contacting customers to change the default credentials used on their estates. Affected organisations are encouraged to log in to their GE Healthcare Product Security Portal accounts to ensure these are changed immediately.
Affected organisations are also encouraged to restrict and monitor the following ports:
- FTP (port 21)
- SSH (port 22)
- Telnet (port 23)
- REXEC (port 512)
Indicators of compromise
Definitive source of threat updates
Last edited: 9 December 2020 2:57 pm