GE CARESCAPE, ApexPro, and Clinical Information Center systems
A vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.CVE-2020-6961 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score. An input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.CVE-2020-6962 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score The affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.CVE-2020-6963 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score The integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.CVE-2020-6964 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score A vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.CVE-2020-6965 has been assigned to this vulnerability. A CVSS v3 base score of 8.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score The affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.CVE-2020-6966 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score