CVE-2017-14006

CRITICAL

GE Xeleris - Improper Authentication via Default or Hard-Coded Credentials

Title source: llm

Description

GE Xeleris versions 1.0,1.1,2.1,3.0,3.1, medical imaging systems, all current versions are affected, these devices use default or hard-coded credentials. Successful exploitation of this vulnerability may allow a remote attacker to bypass authentication and gain access to the affected devices.

References (1)

Core 1

Core References

Mitigation, Third Party Advisory, US Government Resource x_refsource_misc

https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02

Scores

CVSS v3 9.8

EPSS 0.0188

EPSS Percentile 76.8%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-287 CWE-798

Status published

Products (5)

ge/xeleris 1.0

ge/xeleris 1.1

ge/xeleris 2.1

ge/xeleris 3.0

ge/xeleris 3.1

Published Mar 20, 2018

Tracked Since Feb 18, 2026