CVE-2017-14008
📋 TL;DR
GE Centricity PACS RA1000 medical imaging devices use default or hard-coded credentials, allowing remote attackers to bypass authentication and gain full access to affected systems. This affects all current versions of these diagnostic image analysis devices used in healthcare settings.
💻 Affected Systems
- GE Centricity PACS RA1000
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of medical imaging systems leading to unauthorized access to patient data, manipulation of diagnostic images, disruption of healthcare services, and potential patient safety risks.
Likely Case
Unauthorized access to medical imaging systems and patient health information (PHI), potential data exfiltration, and system manipulation affecting diagnostic workflows.
If Mitigated
Limited impact with proper network segmentation and access controls, though the fundamental authentication bypass remains present.
🎯 Exploit Status
Exploitation requires only knowledge of the hard-coded/default credentials, which are likely documented or easily discovered. No special tools or skills needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified in available advisories
Vendor Advisory: https://ics-cert.us-cert.gov/advisories/ICSMA-18-037-02
Restart Required: No
Instructions:
Contact GE Healthcare for specific remediation guidance. No official patch was mentioned in the ICS-CERT advisory.
🔧 Temporary Workarounds
Network Segmentation
allIsolate GE Centricity PACS RA1000 devices on separate VLANs with strict firewall rules limiting access to authorized medical personnel only.
Credential Rotation
allChange all default credentials if the device allows credential modification. Implement strong, unique passwords for all accounts.
🧯 If You Can't Patch
- Implement strict network access controls allowing only necessary connections from authorized medical workstations
- Monitor network traffic to/from these devices for unauthorized access attempts and credential usage
🔍 How to Verify
Check if Vulnerable:
Check device configuration for use of default or hard-coded credentials. Attempt authentication using known default credentials for GE medical devices.Check Version:
Check device interface or contact GE Healthcare support for version informationVerify Fix Applied:
Verify that default credentials no longer work and that strong, unique credentials are required for authentication.📡 Detection & Monitoring
Log Indicators:
- Failed authentication attempts followed by successful logins, multiple login attempts from unusual IP addresses, administrative access from non-medical workstations
Network Indicators:
- Authentication traffic to device management interfaces from unauthorized network segments, unusual data transfers from imaging devices
SIEM Query:
source_ip NOT IN (authorized_medical_ips) AND dest_ip IN (pacs_device_ips) AND (event_type="authentication_success" OR protocol="ssh" OR protocol="telnet")