CVE-2020-6961
First published: Fri Jan 24 2020(Updated: )
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Gehealthcare Apexpro Telemetry Server Firmware | <=4.2 | |
| Gehealthcare Apexpro Telemetry Server | ||
| Gehealthcare Carescape Central Station Mai700 Firmware | =1.0 | |
| Gehealthcare Carescape Central Station Mai700 | ||
| Gehealthcare Carescape Central Station Mas700 Firmware | =1.0 | |
| Gehealthcare Carescape Central Station Mas700 | ||
| Gehealthcare Clinical Information Center Mp100d Firmware | =4.0 | |
| Gehealthcare Clinical Information Center Mp100d Firmware | =5.0 | |
| Gehealthcare Clinical Information Center Mp100d | ||
| Gehealthcare Clinical Information Center Mp100r Firmware | =4.0 | |
| Gehealthcare Clinical Information Center Mp100r Firmware | =5.0 | |
| Gehealthcare Clinical Information Center Mp100r | ||
| Gehealthcare Carescape Telemetry Server Mp100r Firmware | <=4.2 | |
| Gehealthcare Carescape Telemetry Server Mp100r Firmware | =4.3 | |
| Gehealthcare Carescape Telemetry Server Mp100r |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-6961?
The severity of CVE-2020-6961 is critical (10 out of 10).
What products are affected by CVE-2020-6961?
ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X.
How can I fix CVE-2020-6961?
Update to a version higher than 4.2 for ApexPro Telemetry Server, CARESCAPE Telemetry Server, and Clinical Information Center, and update to a version higher than 1.0 for CARESCAPE Central Station.
Where can I find more information about CVE-2020-6961?
You can find more information about CVE-2020-6961 at the following references: [US-CERT Advisory](https://www.us-cert.gov/ics/advisories/icsma-20-023-01), [GE Healthcare Gateway Project Implementation Guide](https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf).
What are the Common Weakness Enumerations (CWE) associated with CVE-2020-6961?
The Common Weakness Enumerations (CWE) associated with CVE-2020-6961 are CWE-522 and CWE-256.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/author
- agent/severity
- agent/tags
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- vendor/gehealthcare
- canonical/gehealthcare apexpro telemetry server firmware
- version/gehealthcare apexpro telemetry server firmware/4.2
- canonical/gehealthcare apexpro telemetry server
- canonical/gehealthcare carescape central station mai700 firmware
- version/gehealthcare carescape central station mai700 firmware/1.0
- canonical/gehealthcare carescape central station mai700
- canonical/gehealthcare carescape central station mas700 firmware
- version/gehealthcare carescape central station mas700 firmware/1.0
- canonical/gehealthcare carescape central station mas700
- canonical/gehealthcare clinical information center mp100d firmware
- version/gehealthcare clinical information center mp100d firmware/4.0
- version/gehealthcare clinical information center mp100d firmware/5.0
- canonical/gehealthcare clinical information center mp100d
- canonical/gehealthcare clinical information center mp100r firmware
- version/gehealthcare clinical information center mp100r firmware/4.0
- version/gehealthcare clinical information center mp100r firmware/5.0
- canonical/gehealthcare clinical information center mp100r
- canonical/gehealthcare carescape telemetry server mp100r firmware
- version/gehealthcare carescape telemetry server mp100r firmware/4.2
- version/gehealthcare carescape telemetry server mp100r firmware/4.3
- canonical/gehealthcare carescape telemetry server mp100r