{"id":"CVE-2020-6966","aliases":["EUVD-2020-28106","GHSA-5w6g-rp5j-mg2g"],"status":"published","title":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior,...","description":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02221,"percentile":0.8281,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-326"],"published":"2020-01-24T17:07:00Z","modified":"2026-06-17T03:24:01Z","products":[{"vendor":"gehealthcare","product":"apexpro_telemetry_server_firmware"},{"vendor":"gehealthcare","product":"carescape_central_station_mai700_firmware"},{"vendor":"gehealthcare","product":"carescape_central_station_mas700_firmware"},{"vendor":"gehealthcare","product":"carescape_telemetry_server_mp100r_firmware"},{"vendor":"gehealthcare","product":"clinical_information_center_mp100d_firmware"},{"vendor":"gehealthcare","product":"clinical_information_center_mp100r_firmware"}],"references":[{"url":"https://www.us-cert.gov/ics/advisories/icsma-20-023-01","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-6966"},{"url":"https://www3.gehealthcare.com/~/media/downloads/us/support/site-planning/site-readiness/gehc-gateway_project_implementation_guide_pdf.pdf","tags":["Product"]},{"url":"https://github.com/advisories/GHSA-5w6g-rp5j-mg2g"}],"sources":{"cve":[{"id":"CVE-2020-6966","description":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.","status":"published","published":"2020-01-24T17:07:00Z","modified":"2024-08-04T09:18:02.517Z","cwes":["CWE-326"],"updated_at":"2026-11-02T14:35:52.592504Z"}],"euvd":[{"id":"EUVD-2020-28106","description":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.","status":"published","published":"2020-01-24T17:07:00Z","modified":"2024-08-04T09:18:02Z","updated_at":"2026-11-03T03:08:01.029528Z"}],"ghsa":[{"id":"GHSA-5w6g-rp5j-mg2g","title":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior,...","description":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.","status":"published","published":"2022-05-24T17:07:19Z","modified":"2023-01-29T05:01:22Z","updated_at":"2026-11-02T14:44:47.932364Z"}],"nvd":[{"id":"CVE-2020-6966","description":"In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 \u0026 prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.","status":"published","published":"2020-01-24T18:15:12.723Z","modified":"2026-06-17T03:24:01.92Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":10,"vector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-326"],"updated_at":"2026-11-02T14:05:52.385274Z"}]}}