CVE-2020-6963: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE…

PriorityP263critical10CVSS 3.1

AVNACLPRNUINSCCHIHAH

EPSS

2.75%

84.3th percentile

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
gehealthcare	apexpro_telemetry_server_firmware	<= 4.2	—
gehealthcare	carescape_central_station_mai700_firmware	—	—
gehealthcare	carescape_central_station_mas700_firmware	—	—
gehealthcare	carescape_telemetry_server_mp100r_firmware	<= 4.2	—
gehealthcare	clinical_information_center_mp100d_firmware	—	—
gehealthcare	clinical_information_center_mp100d_firmware	—	—
gehealthcare	clinical_information_center_mp100r_firmware	—	—
gehealthcare	clinical_information_center_mp100r_firmware	—	—

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.