CVE-2020-6966

highpriority · track · 41EPSS 0.022 · 83 %ileEUUS
grimoire priorityP2 · Scheduled
Exploitable?
—
no known exploitation
Likely / severe?
2.22% (83rd) EPSS
CVSS 10 · high
Is it mine?
28 products
Check your exposure
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · scored 2026-10-27

In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.

01

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

  • FixedApexPro Telemetry Servercisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

  • FixedB450cisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

  • FixedB650cisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

  • FixedB850cisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

  • FixedCARESCAPE Central Station (CSCS)cisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

  • FixedCARESCAPE Telemetry Servercisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

  • FixedClinical Information Center (CIC)cisa_csaf_ot

    GE recommends that, in addition to applying network management best practices, users ensure:

02

cvss

Technical severity, 0–10. One row per scoring source.

10.0
010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 9.1–10

v2.010highAV:N/AC:L/Au:N/C:C/I:C/A:Cprimary · NVD / NIST USexploitability 10 · impact 10
v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 6
v3.010criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · CISA US
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)
03

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-326USprimaryCWE-326US
04

affected products (28)

Products and version ranges known to be affected.

showing 20 of 28
05

advisories (1)

Vendor and ecosystem advisories describing this.

  • ICSMA-20-023-01GE CARESCAPE, ApexPro, and Clinical Information Center systems2020-01-23icsa · cisa_csaf_otUS

    Successful exploitation of these vulnerabilities could occur when an attacker gains access to the mission critical (MC) and/or information exchange (IX) networks due to improper configuration or physical access to devices. An exploit could result in a loss of monitoring and/or loss of alarms during active patient monitoring. These vulnerabilities, if exploited, may allow an attacker to obtain PHI data, make changes at the operating system level of the device, with effects such as rendering the device unusable, otherwise interfering with the function of the device and/or making certain changes to alarm settings on connected patient monitors, and/or utilizing services used for remote viewing and control of devices on the network to access the clinical user interface and make changes to device settings and alarm limits, which could result in missed or unnecessary alarms or silencing of some alarms.

06

also known as (3)

Other names and identifiers for this entity.

07

sources

Which sources assert this record, and when.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
published 2020-01-24modified 2026-06-17
09

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan