CVE-2020-6965

high-risk

Published 2020-01-24

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.

Do I need to act?

0.30% chance of exploitation

EPSS score — low exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.9/10 Critical

NETWORK / LOW complexity

Affected Products (13)

Apexpro Telemetry Server Firmware

Carescape B450 Monitor Firmware

Carescape B650 Monitor Firmware

Carescape B850 Monitor Firmware

Carescape Central Station Mai700 Firmware

Carescape Central Station Mas700 Firmware

Clinical Information Center Mp100D Firmware

Clinical Information Center Mp100R Firmware

Carescape Telemetry Server Mp100R Firmware

Affected Vendors

Gehealthcare

References (3)

Third Party Advisory https://www.us-cert.gov/ics/advisories/icsma-20-023-01

Product https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-re...

Third Party Advisory https://www.us-cert.gov/ics/advisories/icsma-20-023-01

/ 100

high-risk

Severity 33/34 · Critical

Exploitability 1/34 · Minimal

Exposure 17/34 · Moderate