CVE-2020-6966
24.01.2020, 18:15
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.Enginsight
| Vendor | Product | Version |
|---|---|---|
| gehealthcare | apexpro_telemetry_server_firmware | 𝑥 ≤ 4.2 |
| gehealthcare | carescape_central_station_mai700_firmware | 1.0 |
| gehealthcare | carescape_central_station_mas700_firmware | 1.0 |
| gehealthcare | clinical_information_center_mp100d_firmware | 4.0 |
| gehealthcare | clinical_information_center_mp100d_firmware | 5.0 |
| gehealthcare | clinical_information_center_mp100r_firmware | 4.0 |
| gehealthcare | clinical_information_center_mp100r_firmware | 5.0 |
| gehealthcare | carescape_telemetry_server_mp100r_firmware | 𝑥 ≤ 4.2 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-326 - Inadequate Encryption StrengthThe software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
- CWE-326 - Inadequate Encryption StrengthThe software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.