CVE-2024-27107: GE HealthCare EchoPAC Auth Bypass Flaw

CVE-2024-27107 Overview

CVE-2024-27107 is a hardcoded credentials vulnerability [CWE-798] affecting GE HealthCare EchoPAC products. EchoPAC is a cardiovascular ultrasound image review and analysis workstation deployed in clinical environments. The flaw stems from a weak account password embedded in the product, which attackers on an adjacent network can leverage to compromise the system.

Successful exploitation enables full compromise of confidentiality, integrity, and availability with a scope change, indicating impact beyond the vulnerable component itself. The vulnerability carries a CVSS 3.1 base score of 9.6 and is classified as critical.

Critical Impact

Adjacent-network attackers can authenticate using weak embedded credentials to gain high-impact access to EchoPAC systems and adjacent clinical resources, with no user interaction required.

Affected Products

• GE HealthCare EchoPAC products (vendor advisory does not enumerate specific versions in NVD data)
• Workstations and clients running EchoPAC software on adjacent clinical networks
• Connected modalities reachable from the EchoPAC environment

Discovery Timeline

• 2024-05-14 - CVE-2024-27107 published to the National Vulnerability Database
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2024-27107

Vulnerability Analysis

The vulnerability is a weak account password issue mapped to CWE-798 (Use of Hard-coded Credentials). EchoPAC ships with an account that uses a weak or predictable password, allowing authentication without legitimate credential issuance.

The attack vector is adjacent network, meaning the attacker must reside on the same logical network segment, such as a clinical VLAN, Wi-Fi network, or Bluetooth-scoped network. Attack complexity is low, no privileges are required, and no user interaction is needed. The scope is changed, indicating that exploitation can affect resources beyond the vulnerable component, such as connected imaging modalities, file shares, or domain resources reachable from the EchoPAC host.

Given the deployment context in cardiology departments, an attacker who authenticates to EchoPAC can access protected health information (PHI), tamper with diagnostic imaging studies, or use the host as a pivot into the broader hospital network.

Root Cause

The root cause is the presence of hardcoded or default credentials within the EchoPAC product. Embedded credentials cannot be rotated by end users through normal account management workflows and are typically shared across all deployments of the same product version. Once disclosed, the credential is effectively a universal key for every affected installation.

Attack Vector

An attacker with adjacent network access enumerates EchoPAC hosts using standard service discovery techniques. The attacker then authenticates to the exposed service with the hardcoded credential, obtaining application-level access. Because no privileges or user interaction are required and the scope changes after exploitation, the attacker can read, modify, or destroy patient studies and may leverage trusted relationships from the EchoPAC host to reach adjacent systems. EPSS data places the exploit probability at 0.148%, but the consequence of a single successful authentication is full compromise.

No public proof-of-concept exploit is referenced in the available data. See the GE Healthcare Security Update for technical details and product-specific guidance.

Detection Methods for CVE-2024-27107

Indicators of Compromise

• Successful logins to EchoPAC accounts from unexpected hosts or at unusual hours, especially from non-clinical workstations on the adjacent network
• Repeated authentication events from the same source against multiple EchoPAC endpoints, indicating credential reuse across installations
• Outbound connections from EchoPAC hosts to internal systems they do not normally communicate with, suggesting use as a pivot point

Detection Strategies

• Inventory all EchoPAC installations and baseline their normal authentication sources, service ports, and peer communications
• Alert on any interactive logon to EchoPAC accounts from sources outside the approved clinical workstation list
• Monitor for lateral movement patterns originating from EchoPAC hosts, including SMB, RDP, and DICOM connections to non-imaging systems

Monitoring Recommendations

• Forward EchoPAC host and application logs to a centralized SIEM or data lake for correlation with network telemetry
• Capture network flow data on clinical VLANs to identify unauthorized devices attempting to reach EchoPAC services
• Review GE HealthCare security advisories on a recurring cadence and map each advisory to the corresponding asset inventory entries

How to Mitigate CVE-2024-27107

Immediate Actions Required

• Contact GE HealthCare to confirm affected EchoPAC versions in your environment and obtain vendor-supplied remediation
• Restrict network access to EchoPAC systems by placing them on isolated VLANs with strict allowlists for clinical workstations and imaging modalities
• Disable or remove any unused accounts on EchoPAC hosts and rotate credentials where the product supports it

Patch Information

GE HealthCare publishes product security guidance through the GE Healthcare Security Update portal. Customers should reference this portal for the official patch, mitigation steps, and version-specific instructions tied to CVE-2024-27107.

Workarounds

• Enforce network segmentation so EchoPAC is only reachable from authorized cardiology workstations and PACS servers
• Apply 802.1X or equivalent network access control on clinical VLANs to prevent rogue devices from reaching EchoPAC services
• Require multi-factor authentication at the network or jump-host layer for any administrative access to EchoPAC hosts
• Disable wireless and Bluetooth interfaces on EchoPAC workstations where they are not clinically required to reduce the adjacent attack surface

# Example: restrict EchoPAC host access to approved clinical subnet using host firewall
# Replace 10.10.20.0/24 with the approved clinical workstation subnet
Netsh advfirewall firewall add rule name="EchoPAC-Allow-Clinical" \
    dir=in action=allow protocol=TCP localport=any \
    remoteip=10.10.20.0/24

Netsh advfirewall firewall add rule name="EchoPAC-Block-Other" \
    dir=in action=block protocol=TCP localport=any \
    remoteip=any