CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
83.5%
Successful exploitation of these vulnerabilities could occur when an attacker gains access to the mission critical (MC) and/or information exchange (IX) networks due to improper configuration or physical access to devices. An exploit could result in a loss of monitoring and/or loss of alarms during active patient monitoring. These vulnerabilities, if exploited, may allow an attacker to obtain PHI data, make changes at the operating system level of the device, with effects such as rendering the device unusable, otherwise interfering with the function of the device and/or making certain changes to alarm settings on connected patient monitors, and/or utilizing services used for remote viewing and control of devices on the network to access the clinical user interface and make changes to device settings and alarm limits, which could result in missed or unnecessary alarms or silencing of some alarms.
The following versions of GE Healthcare Monitoring platforms are affected:
A vulnerability exists in the affected products that could allow an attacker to obtain access to the SSH private key in configuration files.
CVE-2020-6961 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score.
An input validation vulnerability exists in the web-based system configuration utility that could allow an attacker to obtain arbitrary remote code execution.
CVE-2020-6962 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score
The affected products utilized hard coded SMB credentials, which may allow an attacker to remotely execute arbitrary code.
CVE-2020-6963 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score
The integrated service for keyboard switching of the affected devices could allow attackers to obtain remote keyboard input access without authentication over the network.
CVE-2020-6964 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score
A vulnerability in the software update mechanism allows an authenticated attacker to upload arbitrary files on the system through a crafted update package.
CVE-2020-6965 has been assigned to this vulnerability. A CVSS v3 base score of 8.5 has been calculated; the CVSS vector string is (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score
The affected products utilize a weak encryption scheme for remote desktop control, which may allow an attacker to obtain remote code execution of devices on the network.
CVE-2020-6966 has been assigned to this vulnerability. A CVSS v3 base score of 10 has been calculated; the CVSS vector string is (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H). To see how this vulnerability affects each unique configuration, please apply the environmental portion of CVSS v3.0 score
Elad Luz of CyberMDX reported these vulnerabilities to CISA.
GE recommends users confirm the proper configuration of the MC and IX networks to ensure that the isolation and configuration meet the requirements listed in the Patient Monitoring Network Configuration Guide, CARESCAPE Network Configuration Guide, and product technical and service manuals. These can be obtained by contacting GE via the customer support portal with a valid support account. A properly isolated network requires an attacker to gain physical access in order to carry out an exploit.
GE recommends that, in addition to applying network management best practices, users ensure:
At the time of the publication of this advisory, GE was not aware of any reported incidences of a cyber attack in a clinical use or any reported injuries associated with any of these vulnerabilities.
In addition, GE is developing software updates/patches with additional security enhancements. In accordance with GE’s continual cybersecurity hygiene process, users can access GE’s security website to receive the most up-to-date information and subscribe to receive notifications when new updates/patches are available.
CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities. Specifically, users should:
CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.
CISA also provides a section for control systems security recommended practices on the ICS webpage on us-cert.gov. Several recommended practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.
Additional mitigation guidance and recommended practices are publicly available on the ICS webpage on us-cert.gov in the Technical Information Paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.
Organizations observing any suspected malicious activity should follow their established internal procedures and report their findings to CISA for tracking and correlation against other incidents.
No known public exploits specifically target these vulnerabilities.
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6961
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6962
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6963
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6964
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6965
web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-6966
cisasurvey.gov1.qualtrics.com/jfe/form/SV_9n4TtB8uttUPaM6?product=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-023-01
cwe.mitre.org/data/definitions/20.html
cwe.mitre.org/data/definitions/256.html
cwe.mitre.org/data/definitions/306.html
cwe.mitre.org/data/definitions/326.html
cwe.mitre.org/data/definitions/434.html
cwe.mitre.org/data/definitions/798.html
public.govdelivery.com/accounts/USDHSCISA/subscriber/new?topic_id=USDHSCISA_138
securityupdate.gehealthcare.com/
twitter.com/CISAgov
twitter.com/intent/tweet?text=GE%20CARESCAPE%2C%20ApexPro%2C%20and%20Clinical%20Information%20Center%20systems+https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-023-01
www.dhs.gov
www.dhs.gov/foia
www.dhs.gov/performance-financial-reports
www.facebook.com/CISA
www.facebook.com/sharer/sharer.php?u=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-023-01&title=GE%20CARESCAPE%2C%20ApexPro%2C%20and%20Clinical%20Information%20Center%20systems
www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-certain-ge-healthcare-clinical-information-central-stations-and
www.fda.gov/MedicalDevices/DigitalHealth/ucm373213.htm
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.first.org/cvss/calculator/3.0#CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
www.gehealthcare.com/support/support-documentation-library
www.instagram.com/cisagov
www.linkedin.com/company/cybersecurity-and-infrastructure-security-agency
www.linkedin.com/sharing/share-offsite/?url=https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-023-01
www.oig.dhs.gov/
www.us-cert.gov/ics
www.us-cert.gov/ics
www.us-cert.gov/ics/recommended-practices
www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B
www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
www.usa.gov/
www.whitehouse.gov/
www.youtube.com/@cisagov
mailto:?subject=GE%20CARESCAPE%2C%20ApexPro%2C%20and%20Clinical%20Information%20Center%20systems&body=www.cisa.gov/news-events/ics-medical-advisories/icsma-20-023-01
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
83.5%