Summary
Successful exploitation of these vulnerabilities could occur when an attacker gains access to the mission critical (MC) and/or information exchange (IX) networks due to improper configuration or physical access to devices. An exploit could result in a loss of monitoring and/or loss of alarms during active patient monitoring. These vulnerabilities, if exploited, may allow an attacker to obtain PHI data, make changes at the operating system level of the device, with effects such as rendering the device unusable, otherwise interfering with the function of the device and/or making certain changes to alarm settings on connected patient monitors, and/or utilizing services used for remote viewing and control of devices on the network to access the clinical user interface and make changes to device settings and alarm limits, which could result in missed or unnecessary alarms or silencing of some alarms.
Vulnerabilities 6
-
Unscored —
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cent…
-
Unscored —
In ApexPro Telemetry Server, Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cent…
-
Unscored —
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cente…
-
Unscored —
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cente…
-
Unscored —
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cente…
-
Unscored —
In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Cente…
Revision history
-
#1
ICSMA-20-023-01 GE CARESCAPE, ApexPro, Clinical Information Center systems
References
-
ICS Advisory ICSMA-20-023-01 Web Version
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-20-023-01
-
Recommended Practices
https://securityupdate.gehealthcare.com/
-
Recommended Practices
https://www.us-cert.gov/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
-
Recommended Practices
https://www.us-cert.gov/ics/tips/ICS-TIP-12-146-01B