Summary: GE HealthCare is disclosing security vulnerabilities within certain products using specific older versions of GE remote connectivity solutions. These vulnerabilities have been reported to GE HealthCare by cybersecurity researcher CyberMDX. The public disclosure of the vulnerabilities is a coordinated action between GE HealthCare and CyberMDX.

Customer action summary:

If you have the below listed products in your environment under GE service contract, connected through specific older versions of GE remote connectivity solutions, you may have a low residual risk after proper network security controls. In these cases, GE HealthCare will proactively change default passwords where possible/applicable and ensure proper product firewall configuration. This proactive action will be taken at a scheduled service interval in the coming year.

If you have the below listed products in your environment and they are NOT connected to these older versions of GE remote connectivity solutions, proper network security controls will by itself properly mitigate the low residual risk.

In either case, no action is needed from the customer for changes on the product itself, and there is no need to actively reach out to GE HealthCare for action. However, customers should ensure proper network security controls are implemented on the local network per this statement.

Background information: In 2018, GE HealthCare worked with a security researcher on a public disclosure of the use of default passwords in certain GE HealthCare medical devices. It was recently brought to our attention by CyberMDX, a different 3rd party researcher, that the combination of default passwords with a specific older version of remote service functionality may allow for a malicious party on the local network to gain a level of access at least comparable to a GE (remote) service user. This potential vulnerability is not directly accessible from outside the customer’s network, since the protection of this remote service connection runs to within the network boundary. However, exposure of the connection (traffic) on the customer’s network to the medical device may allow for a malicious party to use the vulnerability to gain access to the device.

There have been no reported incidents in a clinical use setting of such a cyber-attack occurring, or any reported injuries as a result of this issue.

Details: A potentially vulnerable scenario has been identified which, if exploited, may allow an attacker who has access to the customer’s network to gain a level of access to GE HealthCare devices, at least comparable to that of a GE (remote) service user. The following potential weaknesses together form this vulnerability:

The use of certain versions of the GE HealthCare Insite 1 remote connectivity which terminate a VPN tunnel within the customer network, combined with:
Situations where the customer or local network administrator does not have the desired confidence in security coverage of the traffic on local networks between the GE HealthCare remote support tunnel and the medical device, combined with:
GE HealthCare devices using default passwords, or changed passwords being sent in cleartext over the local network.

If the above weaknesses were exploited by a malicious party who has gained access to the customer network, that party may be able to gain a level of access which at a high level would allow access to service tools used to perform maintenance and troubleshooting on the product.

Safety Statement: We have performed a rigorous left-right look throughout our product portfolio, followed by safety risk assessment of all products potentially impacted to assess worst-case scenarios of access and their potential outcome. The result of these assessments is that there is no safety concern associated, and you may continue to use the devices. In an abundance of caution, depending on customer’s confidence in local network security, recommended best practices are described below.

Actions and security recommendations: Since the initial disclosure in 2018, GE HealthCare has made numerous improvements to product design development, install and service processes to ensure improvements in password use as we mature our medical device security posture in line or ahead of industry standards.

The above situation only applies to the specific product versions listed below. Starting January 2021, GE HealthCare will plan action at a service event for contracted connected systems on this list, to address default passwords where possible and ensure product firewall configurations are properly set. No action is needed from the customer for changes on the product itself, and there is no need to actively reach out to GE HealthCare for action. However, customers should ensure proper network security controls are implemented on the local network per this statement.

Modality	Product
MR	3.0T Signa HDxt / 3.0T Signa HDx, versions HD 16, HD23 1.5T Brivo MR355 / Optima MR360, versions SV20.1, SV23.0 1.5T Signa HDx / 1.5T Signa HDx, Signa HDi / Signa VIBRANT, versions HD16, HD23
Ultrasound, General Imaging	LOGIQ 5 [BT03], LOGIQ 7 [BT03, BT04, BT06], LOGIQ 9 [BT02, BT03, BT04, BT06]
Ultrasound, Cardiovascular	Vivid I [BT06], Vivid 7 [BT02-BT06], EchoPAC (Turnkey) [BT06], Image Vault (Turnkey) [4.3]
Ultrasound, Women’s Health	Voluson 730 [BT05, BT08]
Computed Tomography	BrightSpeed Elite, Elite Select, versions 11BW46.3, 17BW11.x, 13BW29.5 BrightSpeed Excel, Edge, Edge Select, version 11BW46.3 Brivo CT385, versions 11BW49.17, 14BW25.15 Discovery CT, versions 11MW44.11, 13MW24.2, 14MW24.7, 16MW34.4, 17BW50.7B, 18BW35.31 Discovery CT590RT, versions 09BW35.1, 10BW06.5, 11BW46.3, 13BW16.3 Discovery CT750HD, versions 11MW44.11, 13MW24.7, 14MW24.7, 16MW34.4, 17BW50.7B LightSpeed VCT, versions 12HW14.6, 13HW31.8 LightSpeed Pro16, version 07MW11.10 LightSpeed RT16, version 07MW11.10 Optima Advance, version 18BW39.6 Optima CT520, versions 11BW46.3, 13BW17.6, 12BW31.11, 14BW25.15, 17BW24.1, 18BW42.9/10 Optima CT540, versions 11BW46.3 14BW25.15, 17BW24.1, 18BW42.9/10 Optima CT660, versions 10HW02.10, 10HW33.8, 11HW34.16, 12HW12.5, 12HW28.8, 13HW38.14, 14HW30.3, 15HW13.7, 15HW25.2 Optima CT580, CT580RT, CT580W, versions 09BW35.1, 10BW06.5, 11BW46.3, 13BW16.3 Optima CT670, versions 17BW34.1, 18BW26.2 Optima CT680 Quantum, Expert, versions 13HW38.14, 15BW21.2, 16BW45.3, 18BW26.1 Optima CT680 Professional, versions 13HW38.14, 15BW21.2, 16BW45.3 Revolution EVO, versions 14HW17.4, 15HW13.7 Revolution HD, versions 11MW44.11, 13MW24.2, 14MW24.7, 16MW34.4, 17BW50.7B, 17BW50.12C/13C Revolution ACT, versions 15BW15.32 & 15BW15.37, 17BW28.09, 17BW35.13 Revolution ACTs, versions 16IW28.23 & 16IW40.8, 17IW22.13 Revolution CT, versions 17MW20.16, 17MW20.22, 18MW18.30 Revolution Discovery CT, versions 11MW44.11, 13MW24.2, 14MW24.7, 16MW34.4, 17BW50.7B, 18BW35.31 Revolution Frontier, versions 17BW50.12C/13C, 18BW35.31 Revolution Frontier ES, versions 17BW50.12C/13C, 18BW35.31
Nuclear Medicine, PET/CT	Brivo NM 615, versions 1.003.028.2-1.003.043.5 Discovery NM 630, versions 1.003.089.0-1.003.613.1, 1.003.621.8-1.003.622.3 Discovery NM 750b, versions 1.002.022.0-1.004.041.0 Discovery NM 530c, versions 1.003.302.2-1.003.534.2 Discovery NM/CT 570c, versions 1.003.302.2-1.003.534.2 Discovery NM/CT 670, versions 1.003.089.0-1.003.613.1, 1.003.621.8 -1.003.622.3 Infinia, versions 2.005.007.17-2.105.030.19 Discovery NM 830, versions 1.003.611.0-1.003.613.1, 1.003.621.8 -1.003.622.3, 1.003.625.9 Discovery NM/CT 850 and NM/CT 860, versions 1.003.611.0-1.003.613.1, 1.003.621.8 -1.003.622.3 Discovery NM/CT 870, versions 1.003.611.0-1.003.613.1, 1.003.621.8 -1.003.622.3 Optima NM/CT 640, versions 1.003.109.0-1.003.613.1, 1.003.621.8 -1.003.622.3 Ventri, version 1.004.050.18 Xeleris WS2.0 and 2.1, version 2.1753 Xeleris 3.0, versions 3.0302-3.0562 Xeleris 3.1, versions 3.1067-3.1108 Xeleris 4.0, versions 4.011-4.0165 PETtrace 800, version 3.6.3 Some versions of Discovery MI, MI DR, IQ, Discovery PET/CT 610, PET/CT 710 PET Discovery IQ, IQ Upgrade
Advanced Visualization	AW 4.0 to AW 4.6, AWS2.0 to AW3.0
Interventional	Innova 2100 Innova X100 family -Innova 3100 / Innova 4100, -Innova 2100-IQ / Innova 3100-IQ / Innova 4100-IQ Innova X1X1 family -Innova 2121-IQ / Innova 3131-IQ Optima family -Optima 320 / Optima CL320i / Optima CL323i, -Optima CL320 / Optima 3100 Optima IGS family -Optima IGS 320, Optima IGS 330 Innova IGS / Discovery IGS family -IGS 5x0, IGS 6x0, IGS 7x0
X-Ray	Fluoro R&F -Precision 500D (Aurora / Aurora Refresh) Fixed Rad -Brivo XR385/DR-F, Brivo XR515/XR575, -Definium 5000, Definium 6000, Definium 8000, -Discovery XR650, Optima XR640, Discovery XR656, -Discovery XR656 G2, Optima XR646 Mobiles -Definium AMX 700 Digital Add-Ons -Brivo XR118, WDR1
Mammography	Seno Advantage, Senographe 2000D, Senographe DS, Senographe Essential

In addition, we highly recommend the use of (clinical) network security best practices at a high level, these may include:

At a Local Area Network (LAN) level, for example the clinical network: ensure segmentation and explicit access rules based on source/destination IP/port for all connections including those used for remote support. Specific ports to consider may include those used for TELNET, FTP, REXEC, and SSH
At a Wide Area Network (WAN) level (for example the broader hospital network where a remote service connection enters from the internet): IPSec VPN and explicit access rules at the internet edge before forward to LAN

The scoring applied to these vulnerabilities represents a situation in default passwords have not been changed, and local networks are not considered trusted. The score assigned is a CVSS v3.1 score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

In properly configured situations, an environmental score should be applied, which GE HealthCare suggests as follows, with the resulting CVSS v3.1 score of 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/MAV:A/MAC:H). For more information on individual vulnerabilities and CVE identifiers, please see the DHS-CISA advisory here.

There have been no reported incidents of a cyber-attack in a clinical use or any reported injuries associated with any of these vulnerabilities.

Please reach out to your local GE Representative for any information regarding network set-up, configuration, maintenance and monitoring, as well as the specific recommendations listed above.

Product Security