Vulnerability Found in GE Anesthesia Machines

GE Healthcare has released a statement claiming the bug is not in the machine itself and does not pose direct risk to patients.

The US Department of Homeland Securitys Industrial Control Systems – Cyber Emergency Response Team (ICS-CERT) has issued a medical advisory for CVE-2019-10966, a vulnerability in GE Aestiva and Aespire Anesthesia machines (versions 7100 and 7900) found by CyberMDX.
If an attacker gains access to a hospital network where either of these devices is connected to a terminal server, they could break into the machine without knowing its IP address or location and force it to use an earlier, less secure version of the communication protocol. This would enable them to remotely change parameters without authorization, forcing severe results.
With this level of access, an attacker could alter the concentration of inspired/expired oxygen, CO2, N2O, and anesthetic agents; change the barometric pressure settings and anesthetic agent type; remotely silence alarms; and change the time and date settings on a machine.
Anesthesiology is a precise science, and anesthesiologists have strict protocols requiring them to document dosages, procedures, vital signs, and other medical data. Reporting is why anesthesia machines are required to the network – it helps accurately record the details. If patients stats are changed or jumbled, it can compromise the integrity of audit trials.
The vulnerability has been assigned a CVSS score of 5.3, indicating medium severity, the ICS-CERT
reports
. It can be exploited remotely and can be exploited with a low level of skill.
GE Healthcare has issued a
statement
in which it says the vulnerability is not in the device itself and this scenario doesnt grant access to data or pose a direct risk to patients. While the machine is in use, any potential gas composition parameter changes, device time changes, or remote alarm silencing will not interfere in any way with the delivery of therapy to a patient at the point of delivery, and do not pose any direct clinical harm, officials explain. GE admits alarms can be silenced; however, physicians would see a visual alert if something went wrong.
Read more details
here
.

Black Hat USA returns to Las Vegas with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the
conference
and
to register.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Vulnerability Found in GE Anesthesia Machines