Critical Security Flaws Uncovered in GE HealthCare Ultrasound Systems
Security researchers have identified multiple vulnerabilities (flaws) in GE HealthCare’s Vivid Ultrasound product line, including the Vivid T9 ultrasound system and the EchoPAC software, which could lead to data manipulation and ransomware attacks.
These flaws, with the most severe being CVE-2024-27107, allow for unauthorized access and execution of arbitrary code. Nozomi Networks outlined an exploit chain using these vulnerabilities, which could be accelerated by exploiting the exposed USB port. GE HealthCare stated that existing mitigations reduce risks, but advised physical security measures. In a separate incident, vulnerabilities in the Merge DICOM Toolkit for Windows and the Siemens SIMATIC Energy Manager were disclosed.
The DICOM Toolkit issues have been addressed in a new version, while the Siemens vulnerability could allow remote code execution with system privileges. Claroty recommended updating EnMPro to version V7.3 Update 1 or later. Additionally, security flaws in the ThroughTek Kalay Platform, patched in April 2024, were discovered, affecting Internet of Things (IoT) devices like baby monitors and security cameras, potentially allowing unauthorized access and remote code execution. Bitdefender emphasized the real-world impact on user privacy and safety.
These incidents underscore the importance of timely updates and robust security measures to mitigate risks in medical and IoT environments.
