GE Ultrasound Gear Riddled With Bugs, Open to Ransomware & Data Theft

Researchers reported 11 vulnerabilities in GE HealthCare Vivid Ultrasound devices and related software (Common Service Desktop Web and EchoPAC) — including hardcoded credentials, command injection, and missing encryption — with severities up to CVSS 9.6; these flaws can enable administrative takeover, patient-data exposure, or ransomware deployment, though many attack paths require physical access while EchoPAC can be abused from the local network. GE HealthCare has published patches and mitigations on its product security portal.