CVE-2020-6977

Published: Feb 20, 2020Modified: Jun 17, 2026

6.8

Vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 0.9 / Impact: 5.9

Source: NVD

Description

A restricted desktop environment escape vulnerability exists in the Kiosk Mode functionality of affected devices. Specially crafted inputs can allow the user to escape the restricted environment, resulting in access to the underlying operating system. Affected devices include the following GE Ultrasound Products: Vivid products - all versions; LOGIQ - all versions not including LOGIQ 100 Pro; Voluson - all versions; Versana Essential - all versions; Invenia ABUS Scan station - all versions; Venue - all versions not including Venue 40 R1-3 and Venue 50 R4-5

Affected (16)

Products: Ge: Vivid E95 Firmware, Vivid E90 Firmware, Vivid S70n Firmware, Vivid T8 Firmware, Vivid T9 Firmware, Vivid Iq Firmware, Logiq E10 Firmware, Logiq E9 Firmware, Logiq S8 Firmware, Logiq S7 Firmware, Logiq P9 Firmware, Logiq E9 With Xdclear Firmware, Voluson Firmware, Versana Essential Firmware, Invenia Abus Scan Station Firmware, Venue Go Firmware

16 products

Logiq E9 With Xdclear Firmware

Voluson Firmware

Versana Essential Firmware

Invenia Abus Scan Station Firmware

Venue Go Firmware

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Vivid E95 Firmware	All versions

Running on/with	Platform Versions
Ge Vivid E95	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Vivid E90 Firmware	All versions

Running on/with	Platform Versions
Ge Vivid E90	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Vivid S70n Firmware	All versions

Running on/with	Platform Versions
Ge Vivid S70n	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Vivid T8 Firmware	All versions

Running on/with	Platform Versions
Ge Vivid T8	All versions

Configuration E

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Vivid T9 Firmware	All versions

Running on/with	Platform Versions
Ge Vivid T9	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Vivid Iq Firmware	All versions

Running on/with	Platform Versions
Ge Vivid Iq	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Logiq E10 Firmware	All versions

Running on/with	Platform Versions
Ge Logiq E10	All versions

Configuration H

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Logiq E9 Firmware	All versions

Running on/with	Platform Versions
Ge Logiq E9	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Logiq S8 Firmware	All versions

Running on/with	Platform Versions
Ge Logiq S8	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Logiq S7 Firmware	All versions

Running on/with	Platform Versions
Ge Logiq S7	All versions

Configuration K

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Logiq P9 Firmware	All versions

Running on/with	Platform Versions
Ge Logiq P9	All versions

Configuration L

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Logiq E9 With Xdclear Firmware	All versions

Running on/with	Platform Versions
Ge Logiq E9 With Xdclear	All versions

Configuration M

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Voluson Firmware	All versions

Running on/with	Platform Versions
Ge Voluson	All versions

Configuration N

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Versana Essential Firmware	All versions

Running on/with	Platform Versions
Ge Versana Essential	All versions

Configuration O

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Invenia Abus Scan Station Firmware	All versions

Running on/with	Platform Versions
Ge Invenia Abus Scan Station	All versions

Configuration P

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Ge Venue Go Firmware	All versions

Running on/with	Platform Versions
Ge Venue Go	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

CWE-693

Protection Mechanism Failure

The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

References (2)

https://www.us-cert.gov/ics/advisories/icsma-20-049-02

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www.us-cert.gov/ics/advisories/icsma-20-049-02

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.