CVE-2020-6966 Weak cryptography in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors

Critical 10.0 Published 24 Jan 2020 Updated 4 Aug 2024

Weak encryption in remote desktop control allows attackers to achieve remote code execution on affected medical telemetry and monitoring devices.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-6966?

CVE-2020-6966 is a critical vulnerability in GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors, published on 24 Jan 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.

Weakness: CWE-326

Which versions are affected by CVE-2020-6966?

It affects 6 products.

Products include Gehealthcare Apexpro Telemetry Server Firmware, Gehealthcare Carescape Central Station Mai700 Firmware, Gehealthcare Carescape Central Station Mas700 Firmware, Gehealthcare Carescape Telemetry Server Mp100r Firmware, Gehealthcare Clinical Information Center Mp100d Firmware, Gehealthcare Clinical Information Center Mp100r Firmware.

How do I fix CVE-2020-6966?

No fix has been published for CVE-2020-6966 yet. Limit exposure of the affected software until one is available.

Is CVE-2020-6966 being exploited?

There is no known exploitation of CVE-2020-6966 in the wild and no public exploit code.

Sources

Also known as GHSA-5w6g-rp5j-mg2g.