CVE-2024-1628

HighCVSS 8.4/10Last modified Jun 17, 2026

Description

OS command injection vulnerabilities in GE HealthCare ultrasound devices

Metrics

CVSS 3.1 8.4/10CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

VendorProductVersions
GE HealthCareVenueR1; R2; >= R3, <= R3.3; >= R4, <= R4.3
GE HealthCareVenue GoR2; >= R3, <= R3.3; >= R4, <= R4.3
GE HealthCareVenue Fit>= R3, <= R3.3; >= R4, <= R4.3
GE HealthCareLOGIQ e>= R7, <= R9.1.4; >= R8, <= R10.1.3; >= R9, <= R11.0.3
GE HealthCareLOGIQ He<= R9.3.1
GE HealthCareVivid E>= E95, < 206; >= E90, < 206; >= E80, < 206
GE HealthCareVivid S>= 70N, < 206; >= 60N, < 206
GE HealthCareVivid T>= T8, < 206; >= T9, < 206
GE HealthCareVivid iq< 206
GE HealthCareVoluson Expert 160; >= BT24, < Ext1
GE HealthCareVoluson Expert 180; >= BT24, < Ext1
GE HealthCareVoluson Expert 220; >= BT24, < Ext1
GE HealthCareVoluson SWIFT0; BT24
GE HealthCareInvenia ABUS 2.0<= 2.2.7
GE HealthCareLOGIQ E10< R3.2.0
GE HealthCareLOGIQ E10s< R3.2.0
GE HealthCareLOGIQ Fortis< R3.2.0
ge_healthcarevenuemultiple versions
ge_healthcarevividmultiple versions
ge_healthcarevolusonmultiple versions
ge_healthcarelogiqmultiple versions

References

Timeline

Published
May 14, 2024
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-16296.2Path traversal vulnerability in “deleteFiles” function of Common Service Desktop, a GE HealthCare ultrasound device componentCVE-2024-16307.7Path traversal vulnerability in “getAllFolderContents” function of Common Service Desktop, a GE HealthCare ultrasound device componentCVE-2024-16319.1Impact: The library offers a function to generate an ed25519 key pair via Ed25519KeyIdentity.generate with an optional param to provide a 32CVE-2024-16326.5Low-privileged users with access to the Sitefinity backend may obtain sensitive information from the site's administrative area.CVE-2024-16332.0During the secure boot, bl2 (the second stage of the bootloader) loops over images defined in the table “bl2_mem_params_descs”. For each imaCVE-2024-16346.5The Scheduling Plugin – Online Booking for WordPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capabiCVE-2024-16357.5A vulnerability was found in Undertow. This vulnerability impacts a server that supports the wildfly-http-client protocol. Whenever a maliciCVE-2024-16365.4Potential Cross-Site Scripting (XSS) in the page editing area.CVE-2024-16374.3The 360 Javascript Viewer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and noncCVE-2024-16389.1The documentation specifies that the BT_GATT_PERM_READ_LESC and BT_GATT_PERM_WRITE_LESC defines for a Bluetooth characteristic: Attribute reCVE-2024-16396.5The License Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on tCVE-2024-16405.3The Contact Form Builder Plugin: Multi Step Contact Form, Payment Form, Custom Contact Form Plugin by Bit Form plugin for WordPress is vulne
CVE-2024-1628: High severity, CVSS 8.4 | Vulnix