Product Security Portal SIGN IN REGISTER GE employee? Sign In Access information on publicly released critical vulnerabilities below. Or you can sign in or register to gain access to GE Healthcare's Product Security Portal - a free, secure, web-based global portal providing credentialed customers a centralized repository to access security updates, the status and required action for GE Healthcare products potentially impacted by critical vulnerabilities, and historical patch product view for released non-critical patches. Critical Vulnerabilities For information on reporting discovered vulnerabilities in GE Healthcare products, view the GE Healthcare Coordinated Vulnerability Disclosure Statement. 2021 2020 Older Original post : Nov 23, 2021– Latest update : Nov 23, 2021 GE Healthcare Guidance On Firewall Usage In Medical Devices Many GE Healthcare products are equipped with firewalls. Firewalls help defend critical systems by establishing another layer of protection between the network and the product. GE Healthcare recommends the following guidance on firewall usage in medical devices. See more > Original post : Nov 10, 2021– Latest update : Nov 10, 2021 NUCLEUS:13 TCP/IP Stack Vulnerabilities GE Healthcare is aware of a group of vulnerabilities named “NUCLEUS:13” that were disclosed by Forescout and Medigate researchers on November 9th, 2021 (https://us-cert.cisa.gov/ics/advisories/icsa-21-313-03). These vulnerabilities impact the Siemens Nucleus Real-time Operating System (RTOS). See more > Original post : Aug 18, 2021– Latest update : Aug 18, 2021 Blackberry QNX RTOS Vulnerability GE Healthcare is aware of a vulnerability impacting the Blackberry QNX Real-time Operating System (RTOS). The vulnerability is related to a memory management flaw in a function of the RTOS. Exploitation of the vulnerability requires external access to QNX. See more > Original post : Jul 08, 2021– Latest update : Jul 20, 2021 PrintNightmare – Critical Windows Print Spooler Vulnerability GE Healthcare is aware of the vulnerability CVE-2021-34527, named “PrintNightmare”. Information on the PrintNightmare vulnerability can be found here: https://us-cert.cisa.gov/ncas/current-activity/2021/06/30/printnightmare-critical-windows-print-spooler-vulnerability GE Healthcare is actively assessing products that utilize impacted Microsoft operating systems to determine possible impact. Please see our GE Healthcare Product Security Portal () for more information. See more > Original post : Dec 18, 2020– Latest update : Jul 02, 2021 GE Healthcare Guidance on Securing Medical Imaging Servers Background In October 2019, Greenbone Networks (a security research company in Germany) found hundreds of medical imaging servers (PACS) open to the Internet exposing sensitive patient information. The researcher was able to use freely available software or even a browser to view medical images and patient data from unsecured systems. We are aware of a repeat alert being sent out on this topic for added awareness and media reports of a growing number of PACS systems open to the Internet. Our recommendations below have not changed since the prior notifications. See more > Original post : Oct 02, 2020– Latest update : May 26, 2021 GE Healthcare recommendations related to ransomware reports in media GE Healthcare recommendations related to ransomware reports in the media Originally posted October 2, 2020, Updated October 30, 2020 and Updated May 26, 2021: This has been updated to include information regarding Conti ransomware attacks. Please review below in its entirety. See more > Original post : Dec 07, 2020– Latest update : May 12, 2021 Vulnerability Disclosure regarding Default Passwords in GE Healthcare Products Summary: GE Healthcare is disclosing security vulnerabilities within certain products using specific remote connectivity solutions. These vulnerabilities have been reported to GE Healthcare by CyberMDX. The public disclosure of the vulnerabilities is a coordinated action between GE Healthcare and CyberMDX. See more > Original post : Apr 23, 2021– Latest update : May 07, 2021 Name:Wreck TCP/IP Stack Vulnerabilities GE Healthcare is aware of TCP/IP stack vulnerabilities named “Name:Wreck” disclosed by Forescout and JSOF researchers on April 13, 2021 (https://us-cert.cisa.gov/ncas/current-activity/2021/04/15/namewreck-dns-vulnerabilities). See more > Original post : Mar 04, 2021– Latest update : Mar 04, 2021 Microsoft Windows TCP/IP (CVE-2021-24074 and CVE-2021-24094 | Remote Code Execution Vulnerabilities) Microsoft has identified remote code execution vulnerabilities in the TCP/IP implementation that affects Windows operating systems. Microsoft indicates that an attacker who successfully exploited the vulnerabilities could then run arbitrary code in the context of the Local System Account, potentially allowing for a Denial of Service (DoS) exploit of these vulnerabilities. GE Healthcare is actively assessing products that utilize impacted Microsoft operating systems to determine whether any are impacted. Please see our GE Healthcare Product Security Portal ( See more > Original post : Feb 11, 2021– Latest update : Feb 11, 2021 Baron Samedit (CVE-2021-3156 | Sudo Elevation of Privilege Vulnerability) Qualys has identified an elevation of privilege vulnerability in “sudo”, a utility available in major Unix-like operating systems. This vulnerability allows an unprivileged user to gain root privileges on hosts with a default sudo configuration. An attacker who successfully exploited the vulnerability can then run specially crafted applications on the device. See more > SHOW MORE VULNERABILITIES United States © 2021 General Electric Company Contact Us Privacy Policy Terms and Conditions Security Feedback