« Volver al listado

CVE-2020-6965

Estado: ModificadaCrítica (9.9)—

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (9)

Gehealthcare — Apexpro Telemetry Server FirmwareGehealthcare — Carescape B450 Monitor FirmwareGehealthcare — Carescape B650 Monitor FirmwareGehealthcare — Carescape B850 Monitor FirmwareGehealthcare — Carescape Central Station Mai700 FirmwareGehealthcare — Carescape Central Station Mas700 FirmwareGehealthcare — Carescape Telemetry Server Mp100r FirmwareGehealthcare — Clinical Information Center Mp100d FirmwareGehealthcare — Clinical Information Center Mp100r Firmware

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-6965",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.9,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "GE CARESCAPE Telemetry Server,ApexPro Telemetry Server,CARESCAPE Central Station,Clinical Information Center systems,CARESCAPE B450,B650,B850 Monitors",
          "versions": [
            {
              "status": "affected",
              "version": "ApexPro Telemetry Server,v4.2 & prior,CARESCAPE Telemetry Server, v4.2 & prior,Clinical Information Center,v4.X& 5.X,CARESCAPE Telemetry Server,v4.3,CARESCAPE Central Station,v1.X,CARESCAPE Central Station,v2.X,B450,v2.X,B650,v1.X,B650,v2.X,B850,v1.X,B850,v2.X"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-01-24T18:15:12.647",
  "references": [
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsma-20-023-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf",
      "tags": [
        "Product"
      ],
      "source": "nvd@nist.gov"
    },
    {
      "url": "https://www.us-cert.gov/ics/advisories/icsma-20-023-01",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        },
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package."
    },
    {
      "lang": "es",
      "value": "En ApexPro Telemetry Server Versiones 4.2 y anteriores, CARESCAPE Telemetry Server Versiones v4.2 y anteriores, Clinical Information Center (CIC) Versiones 4.X y 5.X, CARESCAPE Central Station (CSCS) Versiones 1.X, B450 Versión 2.X, B650 Versión 1.X, B650 Versión 2.X, B850 Versión 1.X, B850 Versión 2.X, una vulnerabilidad en el mecanismo de actualización de software permite a un atacante autenticado cargar archivos arbitrarios en el sistema por medio de un paquete de actualización diseñado."
    }
  ],
  "lastModified": "2026-06-17T03:24:01.800",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:apexpro_telemetry_server_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4C5DD75E-7D4D-4B05-A84D-EDEAA2D23E59",
              "versionEndIncluding": "4.2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:apexpro_telemetry_server:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "A94476A1-B004-4561-918D-C41631F36D9F"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_b450_monitor_firmware:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C9607F33-BAC9-4F45-8685-9091CBBF4336"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:carescape_b450_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FDF68D5F-E436-492A-965E-0E9E254ACBFF"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_b650_monitor_firmware:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF1DCCAF-A4E6-484B-953D-9352C85DE894"
            },
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_b650_monitor_firmware:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D9A5B8CF-5214-4056-87CD-CD1F98142BD6"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:carescape_b650_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "3B149BFB-BB31-4FFC-BC4D-299AB326136D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_b850_monitor_firmware:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDE014C2-9814-4137-9270-9B2AB55D3ABF"
            },
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_b850_monitor_firmware:2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AD10A852-3E11-4436-B771-53A9947A355E"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:carescape_b850_monitor:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "7B8CA355-421A-44DE-A7EA-0BC0ACFDD697"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_central_station_mai700_firmware:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28F6C17B-2288-4EA1-B89F-6E1FED96ADD1"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:carescape_central_station_mai700:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "4C2C8D13-A1C6-4DD1-9886-F925E2158C3A"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_central_station_mas700_firmware:1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "85D5EF4C-F118-4CA9-93C1-6366303F8893"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:carescape_central_station_mas700:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "42991B9E-1D70-4A40-A283-162F2A73669B"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:clinical_information_center_mp100d_firmware:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2FE710E0-76E4-4F7E-890C-9AEB00F5DB13"
            },
            {
              "criteria": "cpe:2.3:o:gehealthcare:clinical_information_center_mp100d_firmware:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "68B32A68-64CF-4579-B465-F1B8F4997C48"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:clinical_information_center_mp100d:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D0E93396-C7BB-4E53-8921-8251DC6A0F75"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:clinical_information_center_mp100r_firmware:4.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "57D4B8E4-C481-446C-BF46-6FB6253344A1"
            },
            {
              "criteria": "cpe:2.3:o:gehealthcare:clinical_information_center_mp100r_firmware:5.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "71F1DE32-2C25-4C0C-A4BF-30F5F3F19C70"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:clinical_information_center_mp100r:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "057C6A3F-BD7E-4655-B9D9-1402C5259D59"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    },
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:gehealthcare:carescape_telemetry_server_mp100r_firmware:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E7A592B9-9BE4-4096-B733-EE9A03D7A610",
              "versionEndIncluding": "4.2"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:gehealthcare:carescape_telemetry_server_mp100r:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "636B9839-E067-4BB0-A5FF-F3B4BE12AB50"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}