Auth bypass in Gehealthcare Apexpro Telemetry Server
CVE-2020-6964
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X and CARESCAPE Central Station (CSCS) Versions 2.X, the integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.
Vulnerability class: Broken Authentication
EPSS: 0.014 (68.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N.
Affected products
- Gehealthcare Apexpro_telemetry_server
- Gehealthcare Apexpro_telemetry_server_firmware
- Gehealthcare Carescape_central_station_mai700
- Gehealthcare Carescape_central_station_mai700_firmware — versions 1.0, 2.0
- Gehealthcare Carescape_central_station_mas700
- Gehealthcare Carescape_central_station_mas700_firmware — versions 1.0, 2.0
- Gehealthcare Carescape_telemetry_server_mp100r
- Gehealthcare Carescape_telemetry_server_mp100r_firmware
- Gehealthcare Clinical_information_center_mp100d
- Gehealthcare Clinical_information_center_mp100d_firmware — versions 4.0, 5.0
Weakness classification (CWE)
References
- ics-cert@hq.dhs.gov (US Government Resource, Third Party Advisory, x_refsource_MISC)
- nvd@nist.gov (Product)
Frequently asked questions
- What is CVE-2020-6964?
- CVE-2020-6964 is a high-severity vulnerability in Gehealthcare Apexpro Telemetry Server, classified under Missing Authentication for Critical Function. CVSS score: 8.6/10. Published 2020-01-24.
- How severe is CVE-2020-6964?
- High severity. CVSS v3 base score is 8.6 out of 10.