CVE-2020-6966

published 2020-01-24

CVE-2020-6966: In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE…

Priority P2 65 critical 10 CVSS 3.1

AV N AC L PR N UI N S C C H I H A H

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.

Affected

8 ranges

Vendor	Product	Version range	Fixed in
gehealthcare	apexpro_telemetry_server_firmware	<= 4.2	—
gehealthcare	carescape_central_station_mai700_firmware	—	—
gehealthcare	carescape_central_station_mas700_firmware	—	—
gehealthcare	carescape_telemetry_server_mp100r_firmware	<= 4.2	—
gehealthcare	clinical_information_center_mp100d_firmware	—	—
gehealthcare	clinical_information_center_mp100d_firmware	—	—
gehealthcare	clinical_information_center_mp100r_firmware	—	—
gehealthcare	clinical_information_center_mp100r_firmware	—	—

CVSS provenance

nvd v3.1 10.0 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-326