Vulnerability

GE CARESCAPE, ApexPro and CIC monitoring systems carry hard-coded SMB credentials and five more critical flaws

MedDevice Cyber Staff · Jan 23 · 4 min read · Via CISA ICSMA-20-023-01

CISA published advisory ICSMA-20-023-01 on January 23, 2020, covering six vulnerabilities in GE patient monitoring infrastructure, reported by Elad Luz of CyberMDX. Affected products are the ApexPro Telemetry Server 4.2 and prior, CARESCAPE Telemetry Server 4.2 and prior and 4.3, CARESCAPE Central Station 1.X and 2.X, Clinical Information Center 4.X and 5.X, and the B450 2.X, B650 1.X and 2.X, and B850 1.X and 2.X monitors.

Five of the six score 10.0 on CVSS v3. CVE-2020-6961 (CWE-256) exposes an SSH private key in configuration files. CVE-2020-6962 (CWE-20) is an input validation flaw in the web-based system configuration utility that gives remote code execution. CVE-2020-6963 (CWE-798) is hard-coded SMB credentials. CVE-2020-6964 (CWE-306) lets an attacker take remote keyboard input through the keyboard switching service with no authentication, and CVE-2020-6966 (CWE-326) is weak encryption on remote desktop control.

The sixth, CVE-2020-6965 (CWE-434, CVSS v3 8.5), lets an authenticated attacker upload arbitrary files through a crafted software update package.

Every path starts with access to the mission critical (MC) or information exchange (IX) network, through misconfiguration or physical access. From there CISA lists loss of monitoring and alarms, theft of PHI, OS-level changes that can render a device unusable, and changes to alarm limits on connected monitors that could silence alarms.

GE did not describe a software fix in the advisory. It tells users to confirm that the MC and IX networks are isolated and configured as the Patient Monitoring Network Configuration Guide, the CARESCAPE Network Configuration Guide and the product manuals require, and notes that a properly isolated network forces an attacker to gain physical access.

The central station is where alarms converge. When its security rests entirely on network isolation, that isolation needs to be audited like any other alarm system component.

Are you a representative of General Electric? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The advisory gives no software fix; GE's mitigation is strict isolation of the MC and IX networks per its Patient Monitoring and CARESCAPE Network Configuration Guides. Verify that isolation on every site running CARESCAPE or ApexPro telemetry servers, Central Station, CIC or B450, B650 and B850 monitors, and control physical access to those networks.

Audit MC and IX network isolation. Compare each site's configuration against GE's Patient Monitoring Network Configuration Guide and CARESCAPE Network Configuration Guide.
Restrict physical access to monitoring networks. A properly isolated network leaves physical access as the only path, so lock down network jacks and central station hardware.
Block SMB and remote desktop at the boundary. Hard-coded SMB credentials and weak remote desktop encryption make both services unsafe outside the isolated segment.
Check GE's security update page. Track GE Healthcare's security update portal for product updates to the affected systems.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

Remote access Web interface Handles patient data Hospital network Field-updatable firmware

Clinical Information Center (CIC)

PID-41

CARESCAPE Central Station (CSCS)

PID-41

CARESCAPE Telemetry Server

PID-41

ApexPro Telemetry Server

PID-41

CARESCAPE B450, B650 and B850 monitors

PID-41

Fix the class in your product

The shared secret ships in every unit, so one recovered credential is fleet-wide access. As the maker, delete embedded secrets from every artifact, provision a unique per-unit identity at manufacture, and force any default to be changed before the device is usable.

Provision a unique secret per unit. Derive it from a hardware-backed root so a dumped image unlocks nothing on another unit.
Remove credentials from shipped artifacts. Pull every secret out of the binary, installer, and app package; verify server-side against a slow hash.
Force default changes at setup. A device that runs on its shipped default should not become operational until the default is changed.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2020-6963 in GE CARESCAPE and ApexPro systems?

CVE-2020-6963 (CWE-798, CVSS v3 10.0) is the use of hard-coded SMB credentials in GE CARESCAPE Telemetry Server, ApexPro Telemetry Server, CARESCAPE Central Station, Clinical Information Center and B450, B650 and B850 monitors, which may allow remote code execution. CISA covered it in ICSMA-20-023-01 on January 23, 2020.

How does GE recommend mitigating the CARESCAPE vulnerabilities in ICSMA-20-023-01?

GE recommends confirming that the mission critical (MC) and information exchange (IX) networks are isolated and configured per the Patient Monitoring Network Configuration Guide, the CARESCAPE Network Configuration Guide and product manuals. CISA advisory ICSMA-20-023-01, published January 23, 2020, covers CVE-2020-6961 to CVE-2020-6966.

Can the GE CARESCAPE vulnerabilities silence patient monitor alarms?

Yes. CISA advisory ICSMA-20-023-01 states exploitation of CVE-2020-6961 to CVE-2020-6966 could change alarm settings and limits on connected GE patient monitors, which could result in missed, unnecessary or silenced alarms, or loss of monitoring.

← Back to Vulnerabilities