PT-2020-19314 · Ge Healthcare · Apexpro Telemetry Server+3

Published 2020-01-24 · Updated 2020-03-17 · CVE-2020-6966

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ApexPro Telemetry Server versions 4.2 and prior CARESCAPE Telemetry Server versions 4.2 and prior Clinical Information Center (CIC) versions 4.X and 5.X CARESCAPE Central Station (CSCS) versions 1.X

Description The affected products use a weak encryption scheme for remote desktop control. This weakness may allow an attacker to obtain remote code execution of devices on the network.

Recommendations For ApexPro Telemetry Server versions 4.2 and prior, consider disabling remote desktop control until a stronger encryption scheme is implemented. For CARESCAPE Telemetry Server versions 4.2 and prior, restrict access to remote desktop control to minimize the risk of exploitation. For Clinical Information Center (CIC) versions 4.X and 5.X, avoid using remote desktop control in sensitive environments until the encryption scheme is updated. For CARESCAPE Central Station (CSCS) versions 1.X, limit network access to devices using remote desktop control to reduce the attack surface. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

Related Identifiers

CVE-2020-6966

Affected Products

Apexpro Telemetry Server

Carescape Central Station

Carescape Telemetry Server

Clinical Information Center

References · 4

• https://osv.dev/vulnerability/CVE-2020-6966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-6966 · Security Note
• https://us-cert.gov/ics/advisories/icsma-20-023-01 · Note
• https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf · Note