CVE-2020-36549

A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://vuldb.com/?id.129835
https://www.scip.ch/?news.20200701

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:ge:voluson_s8_firmware:-:*:*:*:*:*:*:*

cpe:2.3:h:ge:voluson_s8:-:*:*:*:*:*:*:*

History

07 Nov 2023, 03:22

Type	Values Removed	Values Added
References	~~(N/A) https://www.scip.ch/?news.20200701 - Third Party Advisory~~	() https://www.scip.ch/?news.20200701 -
References	~~(N/A) https://vuldb.com/?id.129835 - Third Party Advisory~~	() https://vuldb.com/?id.129835 -

30 Jun 2022, 14:22

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 7.2 v3 : 7.8
CWE		NVD-CWE-noinfo
CPE		cpe:2.3:h:ge:voluson_s8:-:::::::* cpe:2.3:o:ge:voluson_s8_firmware:-:::::::*
References	~~(N/A) https://www.scip.ch/?news.20200701 -~~	(N/A) https://www.scip.ch/?news.20200701 - Third Party Advisory
References	~~(N/A) https://vuldb.com/?id.129835 -~~	(N/A) https://vuldb.com/?id.129835 - Third Party Advisory
First Time		Ge Ge voluson S8 Firmware Ge voluson S8

17 Jun 2022, 13:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-06-17 13:15

Updated : 2023-12-10 14:22

NVD link : CVE-2020-36549

Mitre link : CVE-2020-36549

CVE.ORG link : CVE-2020-36549

JSON object : View

Products Affected

ge

voluson_s8
voluson_s8_firmware

CWE

NVD-CWE-noinfo CWE-269

Improper Privilege Management

{"id": "CVE-2020-36549", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2022-06-17T13:15:12.067", "references": [{"url": "https://vuldb.com/?id.129835", "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.scip.ch/?news.20200701", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed."}, {"lang": "es", "value": "Se ha encontrado una vulnerabilidad clasificada como cr\u00edtica en GE Voluson S8. Est\u00e1 afectado el sistema operativo Windows XP subyacente. La falta de parches podr\u00eda introducir una superficie de ataque excesiva. Es requerido acceso a la red local para que este ataque tenga \u00e9xito"}], "lastModified": "2023-11-07T03:22:16.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:ge:voluson_s8_firmware:-:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4BEFE93-8264-43DC-AC82-F8EFF6800AF3"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:ge:voluson_s8:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "7E5D3069-7828-4860-B072-4180AF0D4B2C"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}