Andrea Palanca and Gabriele Quagliarella of Nozomi Networks

Elevation of privilege vulnerability in GE HealthCare EchoPAC products

Insufficiently protected credentials in GE HealthCare EchoPAC products

Non privileged access to critical file vulnerability in GE HealthCare EchoPAC products

Weak account password in GE HealthCare EchoPAC products

Vulnerable data in transit in GE HealthCare EchoPAC products

Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device component

Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device component

OS command injection vulnerabilities in GE HealthCare ultrasound devices

Elevation of privileges via misconfigured access control list in GE HealthCare ultrasound devices

Missing Authentication for Critical Function