Quantum Secular Labs / Blog / Advisories

CVE-2001-1594: GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user…

CVE-2001-1594 has a CVSS v2 base score of 10.0 (the maximum on that scale) and affects Gehealthcare Entegra P&R. Per its scoring, it can be exploited over the network, without authentication. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, and possibly other accounts, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.

Severity breakdown

CVSS v2.0 10.0: AV:N/AC:L/Au:N/C:C/I:C/A:C

  • Access vector: Network. Exploitable remotely over the network.
  • Access complexity: Low. No special conditions are required.
  • Authentication: None. No authentication is needed.
  • Confidentiality impact: Complete. Total information disclosure.
  • Integrity impact: Complete. Total loss of integrity.
  • Availability impact: Complete. Total shutdown of the component.

Affected products

  • Gehealthcare Entegra P&R: all versions listed by NVD

References