PT-2020-19311 · Ge Healthcare · Apexpro Telemetry Server+3

Published 2020-01-24 · Updated 2020-03-17 · CVE-2020-6963

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ApexPro Telemetry Server versions 4.2 and prior CARESCAPE Telemetry Server versions 4.2 and prior Clinical Information Center (CIC) versions 4.X and 5.X CARESCAPE Central Station (CSCS) versions 1.X

Description The affected products use hard-coded SMB credentials, which could allow an attacker to remotely execute arbitrary code.

Recommendations For ApexPro Telemetry Server versions 4.2 and prior, update to a version that does not use hard-coded SMB credentials. For CARESCAPE Telemetry Server versions 4.2 and prior, update to a version that does not use hard-coded SMB credentials. For Clinical Information Center (CIC) versions 4.X and 5.X, update to a version that does not use hard-coded SMB credentials. For CARESCAPE Central Station (CSCS) versions 1.X, update to a version that does not use hard-coded SMB credentials.

Fix

Using Hardcoded Credentials

RCE

Weakness Enumeration

CWE-798

CWE-20

Related Identifiers

CVE-2020-6963

Affected Products

Apexpro Telemetry Server

Carescape Central Station

Carescape Telemetry Server

Clinical Information Center

References · 4

• https://osv.dev/vulnerability/CVE-2020-6963 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6963 · Security Note
• https://us-cert.gov/ics/advisories/icsma-20-023-01 · Note
• https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf · Note