CVE-2020-6962

CRITICAL

GE Healthcare ApexPro Telemetry Server < 4.2 - Remote Code Execution via Web Configuration Utility

Title source: llm

Description

In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X CARESCAPE Central Station (CSCS) Versions 2.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, an input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.

References (2)

Core 2

Core References

Third Party Advisory, US Government Resource x_refsource_misc

https://www.us-cert.gov/ics/advisories/icsma-20-023-01

Product

https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf

Scores

CVSS v3 10.0

EPSS 0.0493

EPSS Percentile 91.1%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (17)

gehealthcare/apexpro_telemetry_server_firmware 4.3

gehealthcare/apexpro_telemetry_server_firmware < 4.2

gehealthcare/carescape_b450_monitor_firmware 2.0

gehealthcare/carescape_b650_monitor_firmware 1.0

gehealthcare/carescape_b650_monitor_firmware 2.0

gehealthcare/carescape_b850_monitor_firmware 1.0

gehealthcare/carescape_b850_monitor_firmware 2.0

gehealthcare/carescape_central_station_mai700_firmware 1.0

gehealthcare/carescape_central_station_mai700_firmware 2.0

gehealthcare/carescape_central_station_mas700_firmware 1.0

... and 7 more

Published Jan 24, 2020

Tracked Since Feb 18, 2026