CVE-2020-6963 Hardcoded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors

Critical 10.0 Published 24 Jan 2020 Updated 4 Aug 2024

Hardcoded SMB credentials in GE Healthcare telemetry and clinical systems allow attackers to remotely execute arbitrary code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-6963?

CVE-2020-6963 is a critical vulnerability in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors, published on 24 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.

Weakness: CWE-20, CWE-798

Which versions are affected by CVE-2020-6963?

It affects 6 products.

Products include Gehealthcare Apexpro Telemetry Server Firmware, Gehealthcare Carescape Central Station Mai700 Firmware, Gehealthcare Carescape Central Station Mas700 Firmware, Gehealthcare Carescape Telemetry Server Mp100r Firmware, Gehealthcare Clinical Information Center Mp100d Firmware, Gehealthcare Clinical Information Center Mp100r Firmware.

How do I fix CVE-2020-6963?

No fix has been published for CVE-2020-6963 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-6963 being exploited?

There is no known exploitation of CVE-2020-6963 in the wild and no public exploit code.

Sources

Also known as GHSA-xrpc-f6j4-wmx4.