#VU25442 Protection Mechanism Failure in GE products - CVE-2020-6977

Vulnerability identifier: #VU25442

Vulnerability risk: Low

CVSSv4.0: 4 [CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2020-6977

CWE-ID: CWE-693

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Vivid products
Hardware solutions / Medical equipment
LOGIQ
Hardware solutions / Medical equipment
Voluson
Hardware solutions / Medical equipment
Versana Essential
Hardware solutions / Medical equipment
Invenia ABUS Scan station
Hardware solutions / Medical equipment
Venue
Hardware solutions / Medical equipment

Vendor: GE

Description

The vulnerability allows a local attacker to gain access to the operating system of affected devices.

The vulnerability exists due to a restricted desktop environment escape in the "Kiosk Mode" functionality. An attacker with physical access can use specially crafted inputs and escape the restricted environment, resulting in access to the underlying operating system.

Note: This vulnerability does not affect LOGIQ 100 Pro, Venue 40 R1-3 and Venue 50 R4-5.

Mitigation
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Vivid products: All versions

LOGIQ: All versions

Voluson: All versions

Versana Essential: All versions

Invenia ABUS Scan station: All versions

Venue: All versions

---

External links
https://ics-cert.us-cert.gov/advisories/icsma-20-049-02

---

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.