CVE-2020-6963
10.0
CRITICAL · CVSS 3.1 · EPSS 2.7% (pctl 86)
In your normal cycle
Critical by CVSS (10), but no sign of active exploitation.
Description
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.
Scoring
| CVSS | 10.0 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 2.75% — more likely to be exploited than 86% of all CVEs |
| Weakness | CWE-798 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2020-01-24 |
| Last modified | 2026-06-17 |
Affected (12)
| Vendor | Product |
|---|---|
| gehealthcare | apexpro telemetry server |
| gehealthcare | apexpro telemetry server firmware |
| gehealthcare | carescape central station mai700 |
| gehealthcare | carescape central station mai700 firmware |
| gehealthcare | carescape central station mas700 |
| gehealthcare | carescape central station mas700 firmware |
| gehealthcare | carescape telemetry server mp100r |
| gehealthcare | carescape telemetry server mp100r firmware |
| gehealthcare | clinical information center mp100d |
| gehealthcare | clinical information center mp100d firmware |
| gehealthcare | clinical information center mp100r |
| gehealthcare | clinical information center mp100r firmware |
References
→ the Explorer · watch your stack · NVD