Elad Luz

**Name of the Vulnerable Software and Affected Versions** Axeda agent (All versions) Axeda Desktop Server for Windows (All versions) **Description** The issue concerns the Axeda agent and Axeda Desktop Server for Windows, where they supply the event log of a specific service when connecting to a certain port. **Recommendations** For Axeda agent (All versions), consider restricting access to the event log to minimize potential risks. For Axeda Desktop Server for Windows (All versions), restrict access to the specific service's event log until a more detailed fix is provided. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell Wyse ThinOS versions 8.6 and prior **Description** The issue is related to an insecure default configuration, which could be exploited by a remote unauthenticated attacker to gain access to sensitive information on the local network. This could lead to the potential compromise of impacted thin clients. **Recommendations** For Dell Wyse ThinOS versions 8.6 and prior, update the configuration to a secure setting to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Dell Wyse ThinOS versions 8.6 and prior **Description** The issue is related to an insecure default configuration, which could be exploited by a remote unauthenticated attacker to access a writable file and manipulate the configuration of any target specific station. **Recommendations** For Dell Wyse ThinOS versions 8.6 and prior, update to a version later than 8.6 to resolve the issue. At the moment, there is no information about additional mitigation measures for this specific vulnerability.

Name of the Vulnerable Software and Affected Versions: GE Healthcare Imaging and Ultrasound Products (affected versions not specified) Description: The issue is related to the exposure of specific credentials during transport over the network due to a lack of protection for service data. This could allow a remote attacker to gain unauthorized access to protected information or elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** GE Aestiva versions 7100 GE Aespire versions 7900 **Description** A vulnerability exists in the specified GE Aestiva and Aespire versions where serial devices connected via an added unsecured terminal server to a TCP/IP network configuration could allow an attacker to remotely modify device configuration and silence alarms. **Recommendations** For GE Aestiva version 7100, consider securing the terminal server connection to prevent unauthorized access. For GE Aespire version 7900, consider securing the terminal server connection to prevent unauthorized access.

**Name of the Vulnerable Software and Affected Versions** Becton, Dickinson and Company (BD) Alaris Plus medical syringe pumps (models Alaris GS, Alaris GH, Alaris CC, and Alaris TIVA) versions prior to 2.3.7 **Description** The issue is related to an improper authentication mechanism where the software fails to authenticate users for certain functionality, potentially allowing a remote attacker to gain unauthorized access to the syringe pumps when connected to a terminal server via the serial port. This could impact the intended operation of the pump. **Recommendations** For versions prior to 2.3.7, update to version 2.3.7 or later to resolve the issue.