Vulnerabilities > Gehealthcare
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2020-12-14 | CVE-2020-25179 | Information Exposure vulnerability in Gehealthcare products GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. | 7.5 |
| 2020-12-14 | CVE-2020-25175 | Insufficiently Protected Credentials vulnerability in Gehealthcare products GE Healthcare Imaging and Ultrasound Products may allow specific credentials to be exposed during transport over the network. | 5.0 |
| 2020-01-24 | CVE-2020-6966 | Inadequate Encryption Strength vulnerability in Gehealthcare products In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network. | 10.0 |
| 2020-01-24 | CVE-2020-6965 | Improper Input Validation vulnerability in Gehealthcare products In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, a vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package. | 6.5 |
| 2020-01-24 | CVE-2020-6964 | Missing Authentication for Critical Function vulnerability in Gehealthcare products In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X and CARESCAPE Central Station (CSCS) Versions 2.X, the integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network. | 5.0 |
| 2020-01-24 | CVE-2020-6963 | Improper Input Validation vulnerability in Gehealthcare products In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Central Station (CSCS) Versions 1.X, the affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code. | 10.0 |
| 2020-01-24 | CVE-2020-6962 | Improper Input Validation vulnerability in Gehealthcare products In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X CARESCAPE Central Station (CSCS) Versions 2.X, B450 Version 2.X, B650 Version 1.X, B650 Version 2.X, B850 Version 1.X, B850 Version 2.X, an input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution. | 10.0 |
| 2020-01-24 | CVE-2020-6961 | Insufficiently Protected Credentials vulnerability in Gehealthcare products In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, CARESCAPE Telemetry Server Version 4.3, CARESCAPE Central Station (CSCS) Versions 1.X, a vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files. | 7.5 |
| 2015-08-04 | CVE-2014-9736 | Credentials Management vulnerability in Gehealthcare Centricity Clinical Archive Audit Trail Repository GE Healthcare Centricity Clinical Archive Audit Trail Repository has a default password of initinit for the (1) SSL key manager and (2) server keystore; (3) keystore_password for the server truststore; and atna for the (4) primary storage database and (5) archive storage database, which has unspecified impact and attack vectors. | 10.0 |
| 2015-08-04 | CVE-2014-7233 | Credentials Management vulnerability in Gehealthcare Precision Thunis-800+ GE Healthcare Precision THUNIS-800+ has a default password of (1) 1973 for the factory default System Utilities menu, (2) TH8740 for installation using TH8740_122_Setup.exe, (3) hrml for "Setup and Activation" using DSASetup, and (4) an empty string for Shutter Configuration, which has unspecified impact and attack vectors. | 10.0 |