CVE-2020-6962

Published: Jan 24, 2020Modified: Nov 21, 2024

10.0

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 6.0

Source: NVD

Description

In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X CARESCAPE Central Station (CSCS) Versions 2.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, an input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.

Affected (17)

Products: Gehealthcare: Apexpro Telemetry Server Firmware, Carescape B450 Monitor Firmware, Carescape B650 Monitor Firmware, Carescape B850 Monitor Firmware, Carescape Central Station Mai700 Firmware, Carescape Central Station Mas700 Firmware, Clinical Information Center Mp100d Firmware, Clinical Information Center Mp100r Firmware, Carescape Telemetry Server Mp100r Firmware

Gehealthcare

9 products

Apexpro Telemetry Server Firmware

Carescape B450 Monitor Firmware

Carescape B650 Monitor Firmware

Carescape B850 Monitor Firmware

Carescape Central Station Mai700 Firmware

Carescape Central Station Mas700 Firmware

Clinical Information Center Mp100d Firmware

Clinical Information Center Mp100r Firmware

Carescape Telemetry Server Mp100r Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Apexpro Telemetry Server Firmware	Up to 4.2
Gehealthcare Apexpro Telemetry Server Firmware	Version 4.3

Running on/with	Platform Versions
Gehealthcare Apexpro Telemetry Server	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Carescape B450 Monitor Firmware	Version 2.0

Running on/with	Platform Versions
Gehealthcare Carescape B450 Monitor	All versions

Configuration C

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Carescape B650 Monitor Firmware	Version 1.0
Gehealthcare Carescape B650 Monitor Firmware	Version 2.0

Running on/with	Platform Versions
Gehealthcare Carescape B650 Monitor	All versions

Configuration D

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Carescape B850 Monitor Firmware	Version 1.0
Gehealthcare Carescape B850 Monitor Firmware	Version 2.0

Running on/with	Platform Versions
Gehealthcare Carescape B850 Monitor	All versions

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Carescape Central Station Mai700 Firmware	Version 1.0
Gehealthcare Carescape Central Station Mai700 Firmware	Version 2.0

Running on/with	Platform Versions
Gehealthcare Carescape Central Station Mai700	All versions

Configuration F

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Carescape Central Station Mas700 Firmware	Version 1.0
Gehealthcare Carescape Central Station Mas700 Firmware	Version 2.0

Running on/with	Platform Versions
Gehealthcare Carescape Central Station Mas700	All versions

Configuration G

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Clinical Information Center Mp100d Firmware	Version 4.0
Gehealthcare Clinical Information Center Mp100d Firmware	Version 5.0

Running on/with	Platform Versions
Gehealthcare Clinical Information Center Mp100d	All versions

Configuration H

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Clinical Information Center Mp100r Firmware	Version 4.0
Gehealthcare Clinical Information Center Mp100r Firmware	Version 5.0

Running on/with	Platform Versions
Gehealthcare Clinical Information Center Mp100r	All versions

Configuration I

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Gehealthcare Carescape Telemetry Server Mp100r Firmware	Up to 4.2
Gehealthcare Carescape Telemetry Server Mp100r Firmware	Version 4.3

Running on/with	Platform Versions
Gehealthcare Carescape Telemetry Server Mp100r	All versions

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (3)

https://www.us-cert.gov/ics/advisories/icsma-20-023-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf

Source: nvd@nist.gov

Product

https://www.us-cert.gov/ics/advisories/icsma-20-023-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.