GE Aestiva and Aespire Anesthesia (Update A)

Risk Summary

Successful exploitation of this vulnerability could allow an attacker the ability to remotely modify GE Healthcare anesthesia device parameters. This results from the configuration exposure of certain terminal server implementations that extend GE Healthcare anesthesia device serial ports to TCP/IP networks.

CVEs (1)

Remediations

• GE Healthcare recommends organizations use secure terminal servers when connecting GE Healthcare anesthesia device serial ports to TCP/IP networks. Secure terminal servers provide robust security features, including strong encryption, VPN, authentication of users, network controls, logging, audit capability, and secure device configuration and management options.
• GE Healthcare recommends that organizations utilize best practices for terminal servers that include governance, management, and secure deployment measures such as network segmentation, VLANs, and device isolation to enhance existing security measures.
• GE Healthcare plans to provide updates and additional security information about this vulnerability for affected users at the following location:
• http://www3.gehealthcare.com/en/support/security
• https://www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm

Affected Vendors

Affected Products (4)

Affected Sectors

Healthcare and Public Health