Back
CVE-2020-6961
CRITICAL
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.
Published: Jan 24, 2020
Modified: Jun 17, 2026
CWE-256
CWE-522
CVSS Metrics
CVSSv3
Attack Vector:
NETWORK
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
CHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products (9)
| Vendor | Product | Version |
|---|---|---|
| gehealthcare | apexpro_telemetry_server_firmware | * |
| gehealthcare | carescape_central_station_mai700_firmware | 1.0 |
| gehealthcare | carescape_central_station_mas700_firmware | 1.0 |
| gehealthcare | clinical_information_center_mp100d_firmware | 4.0 |
| gehealthcare | clinical_information_center_mp100d_firmware | 5.0 |
| gehealthcare | clinical_information_center_mp100r_firmware | 4.0 |
| gehealthcare | clinical_information_center_mp100r_firmware | 5.0 |
| gehealthcare | carescape_telemetry_server_mp100r_firmware | * |
| gehealthcare | carescape_telemetry_server_mp100r_firmware | 4.3 |
GitHub Security Advisory GHSA-h5jv-7mvc-m9hg
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior,...
References (3)
- https://www.us-cert.gov/ics/advisories/icsma-20-023-01 Third Party Advisory, US Government Resource
- https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf Product
- https://www.us-cert.gov/ics/advisories/icsma-20-023-01 Third Party Advisory, US Government Resource
Risk Scores
CVSS Score
10.0 / 10
EPSS Score
1.62%
Top 26% most likely to be exploited
Threat Score
40.5 / 100
Data Sources
NVD
EPSS
GitHub