CVE-2012-6693 in Healthcare Centricity PACS
Summary
by MITRE
GE Healthcare Centricity PACS 4.0 Server has a default password of (1) nasro for the nasro (ReadOnly) user and (2) nasrw for the nasrw (Read/Write) user, which has unspecified impact and attack vectors.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/04/2017
The vulnerability identified in GE Healthcare Centricity PACS 4.0 Server represents a critical authentication flaw that exposes medical imaging systems to unauthorized access and potential data compromise. This weakness stems from the implementation of default credentials that persist across system deployments without proper administrative intervention. The presence of hardcoded passwords for both read-only and read/write administrative accounts creates a fundamental security weakness that violates basic security principles and industry best practices. The default credentials are particularly concerning because they remain unchanged across installations, creating a predictable attack surface that malicious actors can exploit immediately upon system discovery. This vulnerability directly impacts the confidentiality, integrity, and availability of medical imaging data stored within the PACS environment.
The technical nature of this flaw aligns with CWE-798, which addresses the use of hard-coded credentials in software systems. The vulnerability exists at the authentication layer where default user accounts with well-known passwords are provisioned without requiring explicit administrative configuration. The specific default passwords of nasro for ReadOnly access and nasrw for Read/Write access provide attackers with immediate access to medical imaging repositories containing sensitive patient information. These credentials bypass all normal authentication mechanisms and provide direct access to system functionalities that should remain restricted to authorized personnel. The unspecified attack vectors suggest that this vulnerability could be exploited through multiple pathways including network reconnaissance, social engineering, or direct system access, making it particularly dangerous in healthcare environments where system availability and data integrity are paramount.
The operational impact of this vulnerability extends beyond simple unauthorized access to encompass significant risks to patient care and organizational compliance. Medical imaging data stored in PACS systems contains highly sensitive personal health information that requires strict protection under regulations such as HIPAA. Unauthorized access to these systems could result in data breaches, medical identity theft, and compromised patient care decisions based on altered or stolen imaging data. The vulnerability creates a persistent risk that remains active until the default passwords are manually changed by system administrators, leaving organizations exposed during the entire deployment and operational lifecycle. Security incident response becomes complicated as the default credentials create a known attack pattern that can be exploited by both malicious actors and automated scanning tools, potentially leading to widespread compromise of healthcare imaging infrastructure.
Mitigation strategies for this vulnerability must include immediate administrative action to change the default passwords for all affected accounts, followed by comprehensive security configuration reviews. Organizations should implement mandatory credential change procedures during system deployment and establish regular password rotation policies for administrative accounts. The implementation of multi-factor authentication and role-based access controls should be prioritized to reduce the impact of any remaining credential-based vulnerabilities. Network segmentation and monitoring solutions should be deployed to detect unauthorized access attempts and credential misuse. This vulnerability highlights the importance of following security standards such as NIST SP 800-123 and ISO 27001, which emphasize the need for proper credential management and the elimination of default accounts with known credentials. Regular security assessments and penetration testing should be conducted to identify similar vulnerabilities in other healthcare systems and prevent the exploitation of predictable security weaknesses across medical imaging infrastructure.