{"id":"CVE-2020-6961","aliases":["EUVD-2020-28101","GHSA-h5jv-7mvc-m9hg"],"status":"published","title":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior,...","description":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01619,"percentile":0.76232,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-256","CWE-522"],"published":"2020-01-24T16:07:45Z","modified":"2026-06-17T03:24:01Z","products":[{"vendor":"gehealthcare","product":"apexpro_telemetry_server_firmware"},{"vendor":"gehealthcare","product":"carescape_central_station_mai700_firmware"},{"vendor":"gehealthcare","product":"carescape_central_station_mas700_firmware"},{"vendor":"gehealthcare","product":"carescape_telemetry_server_mp100r_firmware"},{"vendor":"gehealthcare","product":"clinical_information_center_mp100d_firmware"},{"vendor":"gehealthcare","product":"clinical_information_center_mp100r_firmware"}],"references":[{"url":"https://www.us-cert.gov/ics/advisories/icsma-20-023-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6961"},{"url":"https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf","tags":["Product"]},{"url":"https://github.com/advisories/GHSA-h5jv-7mvc-m9hg"}],"sources":{"cve":[{"id":"CVE-2020-6961","description":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.","status":"published","published":"2020-01-24T16:07:45Z","modified":"2024-08-04T09:18:02.493Z","cwes":["CWE-256"],"updated_at":"2026-11-02T14:35:52.268457Z"}],"euvd":[{"id":"EUVD-2020-28101","description":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.","status":"published","published":"2020-01-24T16:07:45Z","modified":"2024-08-04T09:18:02Z","updated_at":"2026-11-03T03:08:01.566283Z"}],"ghsa":[{"id":"GHSA-h5jv-7mvc-m9hg","title":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior,...","description":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.","status":"published","published":"2022-05-24T17:07:18Z","modified":"2023-01-29T05:01:10Z","updated_at":"2026-11-02T14:44:45.404949Z"}],"nvd":[{"id":"CVE-2020-6961","description":"In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.","status":"published","published":"2020-01-24T17:15:13.03Z","modified":"2026-06-17T03:24:01.343Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-256","CWE-522"],"updated_at":"2026-11-02T14:05:52.385274Z"}]}}