Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2004-2777: Centricity Image Vault 3.x uses default admin passwords

CVE-2004-2777 · published 11 years ago

Summary

The Centricity Image Vault 3.x system includes several accounts with well‑known or blank passwords, such as "gemnet" and "webadmin". This makes it easy for an attacker who discovers the system to log in and potentially view or modify medical images and related data. Change all default and empty passwords to strong, unique values as soon as possible.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
gehealthcare	centricity_image_vault_firmware	All versions `cpe:2.3:o:gehealthcare:centricity_image_vault_firmware::::::::`

Original advisory text

GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002 account of the GEMNet license server, which has unspecified impact and attack vectors. NOTE: it is not clear whether this password is default, hardcoded, or dependent on another system or product that requires a fixed value.

References

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

10.0 Critical

Exploitation

2% chance of attack within 30 days

Type

CWE-255Credentials Management Errors

Timeline

Published4 Aug 2015

Updated3 Nov 2026

First seen29 Sep 2026

Sources

CVE-2004-2777 · NVD

Track software like this

Free during beta