CVE-2020-6961In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE…
Updated under an hour ago ()
Does this affect you?
It affects gehealthcare apexpro_telemetry_server_firmware and 5 other products. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 1.62%, higher than 76% of scored CVEs.
Do this next
Free account, 1 product
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.
- CVSS
- 10.0 CRITICAL (v3.1, NVD)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
- Weakness (CWE)
- CWE-256
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 1.62% (percentile 76)
- Assigned by
- icscert
- NVD analysis
- Modified
- Record last updated
- Aug 4, 2024
- First seen by InfoSec Signals
- Oct 12, 2026
Affected products
gehealthcare apexpro_telemetry_server_firmware gehealthcare:apexpro_telemetry_server_firmware | through 4.2 | NVD |
gehealthcare carescape_central_station_mai700_firmware gehealthcare:carescape_central_station_mai700_firmware | 1.0 | NVD |
gehealthcare carescape_central_station_mas700_firmware gehealthcare:carescape_central_station_mas700_firmware | 1.0 | NVD |
gehealthcare clinical_information_center_mp100d_firmware gehealthcare:clinical_information_center_mp100d_firmware | 4.0; 5.0 | NVD |
gehealthcare clinical_information_center_mp100r_firmware gehealthcare:clinical_information_center_mp100r_firmware | 4.0; 5.0 | NVD |
gehealthcare carescape_telemetry_server_mp100r_firmware gehealthcare:carescape_telemetry_server_mp100r_firmware | through 4.2; 4.3 | NVD |
References
- https://www.us-cert.gov/ics/advisories/icsma-20-023-01x-refsource-misc, third-party-advisory, us-government-resource
- https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdfproduct
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.