CVE-2020-6964 Missing authorization in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
Attackers can remotely access keyboard input without authentication on GE CARESCAPE telemetry systems, potentially compromising patient monitoring integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-6964?
CVE-2020-6964 is a high-severity missing authorization vulnerability in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors, published on 24 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X and CARESCAPE Central Station (CSCS) Versions 2.X, the integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.
Weakness: CWE-306
Which versions are affected by CVE-2020-6964?
It affects 6 products.
Products include Gehealthcare Apexpro Telemetry Server Firmware, Gehealthcare Carescape Central Station Mai700 Firmware, Gehealthcare Carescape Central Station Mas700 Firmware, Gehealthcare Carescape Telemetry Server Mp100r Firmware, Gehealthcare Clinical Information Center Mp100d Firmware, Gehealthcare Clinical Information Center Mp100r Firmware.
How do I fix CVE-2020-6964?
No fix has been published for CVE-2020-6964 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2020-6964 being exploited?
There is no known exploitation of CVE-2020-6964 in the wild and no public exploit code.
Other vulnerabilities in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
- CVE-2020-6961 Hardcoded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center,CARESCAPE B450,B650,B850 Monitors
- CVE-2020-6962 Code injection in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center,CARESCAPE B450,B650,B850 Monitors
- CVE-2020-6963 Hardcoded credentials in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
- CVE-2020-6966 Weak cryptography in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
- CVE-2020-6965 File upload in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors
Sources
Also known as GHSA-q967-h7g6-h4j3.