cbcvebase.
CVE-2020-6965
published 2020-01-24

CVE-2020-6965: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE…

PriorityP358critical9.9CVSS 3.1
AVNACLPRLUINSCCHIHAH
EPSS
1.13%
62.3th percentile
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.

Affected

13 ranges
VendorProductVersion rangeFixed in
gehealthcareapexpro_telemetry_server_firmware<= 4.2—
gehealthcarecarescape_b450_monitor_firmware——
gehealthcarecarescape_b650_monitor_firmware——
gehealthcarecarescape_b650_monitor_firmware——
gehealthcarecarescape_b850_monitor_firmware——
gehealthcarecarescape_b850_monitor_firmware——
gehealthcarecarescape_central_station_mai700_firmware——
gehealthcarecarescape_central_station_mas700_firmware——
gehealthcarecarescape_telemetry_server_mp100r_firmware<= 4.2—
gehealthcareclinical_information_center_mp100d_firmware——
gehealthcareclinical_information_center_mp100d_firmware——
gehealthcareclinical_information_center_mp100r_firmware——
gehealthcareclinical_information_center_mp100r_firmware——

CVSS provenance

nvdv3.19.9CRITICALCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.