{"cve":"CVE-2010-5308","nvd":{"published":"2015-08-04T14:59:11.503","modified":"2026-06-16T23:26:31.823","status":"Modified","description":"GE Healthcare Optima MR360 does not require authentication for the HIPAA emergency login procedure, which allows physically proximate users to gain access via an arbitrary username in the Emergency Login screen.  NOTE: this might not qualify for inclusion in CVE if unauthenticated emergency access is part of the intended security policy of the product, can be controlled by the system administrator, and is not enabled by default.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-255"],"references":["http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4","http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/","https://twitter.com/digitalbond/status/619250429751222277","http://apps.gehealthcare.com/servlet/ClientServlet/MR360+operator+manual+paper.pdf?REQ=RAA&DIRECTION=5339461-1EN&FILENAME=MR360%2Boperator%2Bmanual%2Bpaper.pdf&FILEREV=4&DOCREV_ORG=4","http://www.forbes.com/sites/thomasbrewster/2015/07/10/vulnerable-breasts/"],"products":["gehealthcare:optima_mr360_firmware"],"source":"nvd","synced_at":"2026-10-19T20:36:40.444340523+00:00"},"epss":{"cve":"CVE-2010-5308","score":0.0182,"percentile":0.7874,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}