CVE-2020-16220: Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of Input
First published: Fri Sep 11 2020(Updated: )
In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certain syntax) but it does not validate or incorrectly validates that the input complies with the syntax, causing the certificate enrollment service to crash. It does not impact monitoring but prevents new devices from enrolling.
Credit: ics-cert@hq.dhs.gov ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Philips Patient Information Center Ix | =b.02 | |
| Philips Patient Information Center Ix | =c.02 | |
| Philips Patient Information Center Ix | =c.03 | |
| Philips Performancebridge Focal Point | =a.01 |
Remedy
Philips released the following versions to remediate reported vulnerabilities: * Patient Information Center iX (PICiX) Version C.03 * PerformanceBridge Focal Point * Certificate revocation within the system was implemented for PIC iX and Performance Bridge FocalPoint.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2020-16220?
The severity of CVE-2020-16220 is medium with a severity value of 4.3.
Which versions of Patient Information Center iX (PICiX) are affected by CVE-2020-16220?
Versions B.02, C.02, and C.03 of Patient Information Center iX (PICiX) are affected by CVE-2020-16220.
Which versions of PerformanceBridge Focal Point are affected by CVE-2020-16220?
Version A.01 of PerformanceBridge Focal Point is affected by CVE-2020-16220.
Which versions of IntelliVue patient monitors are affected by CVE-2020-16220?
Versions N and prior of IntelliVue patient monitors MX100, MX400-MX850, and MP2-MP90 are affected by CVE-2020-16220.
What is the Common Weakness Enumeration (CWE) ID for CVE-2020-16220?
The Common Weakness Enumeration (CWE) ID for CVE-2020-16220 is CWE-1286.
- collector/nvd-index
- collector/nvd-api
- agent/author
- agent/references
- agent/type
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/remedy
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- vendor/philips
- canonical/philips patient information center ix
- version/philips patient information center ix/b.02
- version/philips patient information center ix/c.02
- version/philips patient information center ix/c.03
- canonical/philips performancebridge focal point
- version/philips performancebridge focal point/a.01