CVE-2020-16228: Philips Patient Monitoring Devices Improper Check for Certificate Revocation
First published: Fri Sep 11 2020(Updated: )
In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a compromised certificate.
Credit: ics-cert@hq.dhs.gov
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Philips Patient Information Center Ix | =b.02 | |
| Philips Patient Information Center Ix | =c.02 | |
| Philips Patient Information Center Ix | =c.03 | |
| Philips Performancebridge Focal Point | =a.01 | |
| All of | ||
| Philips Intellivue NP90 Firmware | ||
| Philips Intellivue MP2-MP90 Firmware | =n | |
| All of | ||
| Philips Intellivue Mx100 Firmware | ||
| Philips Intellivue Mx100 Firmware | ||
| All of | ||
| Philips Intellivue Mx400 Firmware | ||
| Philips Intellivue Mx400 Firmware | ||
| All of | ||
| Philips Intellivue Mx850 Firmware | ||
| Philips Intellivue Mx850 Firmware | ||
| All of | ||
| Philips Intellivue X2 Firmware | ||
| Philips Intellivue X2 Firmware | =n | |
| All of | ||
| Philips Intellivue X3 Firmware | ||
| Philips Intellivue X3 Firmware | =n | |
| All of | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue Mx800 Firmware | ||
| All of | ||
| Philips Intellivue Mx750 Firmware | ||
| Philips Intellivue Mx750 Firmware | ||
| All of | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| All of | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue Mx600 Firmware | ||
| All of | ||
| Philips Intellivue Mx550 | ||
| Philips Intellivue Mx550 Firmware | ||
| Philips Intellivue NP90 Firmware | ||
| Philips Intellivue MP2-MP90 Firmware | =n | |
| Philips Intellivue Mx100 Firmware | ||
| Philips Intellivue Mx100 Firmware | ||
| Philips Intellivue Mx400 Firmware | ||
| Philips Intellivue Mx400 Firmware | ||
| Philips Intellivue Mx850 Firmware | ||
| Philips Intellivue Mx850 Firmware | ||
| Philips Intellivue X2 Firmware | ||
| Philips Intellivue X2 Firmware | =n | |
| Philips Intellivue X3 Firmware | ||
| Philips Intellivue X3 Firmware | =n | |
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue Mx800 Firmware | ||
| Philips Intellivue Mx750 Firmware | ||
| Philips Intellivue Mx750 Firmware | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue MP Monitors MX800/700/600 Firmware | ||
| Philips Intellivue Mx600 Firmware | ||
| Philips Intellivue Mx550 | ||
| Philips Intellivue Mx550 Firmware |
Remedy
Philips released the following versions to remediate reported vulnerabilities: * Patient Information Center iX (PICiX) Version C.03 * PerformanceBridge Focal Point * IntelliVue Patient Monitors Versions N.00 and N.01 * IntelliVue Patient Monitors Version M.04: Contact a Philips service support team https://www.usa.philips.com/healthcare/solutions/customer-service-solutions for an upgrade path * Certificate revocation within the system was implemented for PIC iX and Performance Bridge FocalPoint in 2023. The implementation of the IntelliVue Patient Monitors will be completed in Q3 of 2024.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID of this vulnerability?
The vulnerability ID of this vulnerability is CVE-2020-16228.
What is the severity of CVE-2020-16228?
The severity of CVE-2020-16228 is medium with a severity value of 6.4.
Which software versions are affected by CVE-2020-16228?
The software versions affected by CVE-2020-16228 are Philips Patient Information Center iX B.02, C.02, C.03, PerformanceBridge Focal Point A.01, IntelliVue patient monitors MX100, MX400-MX850, and MP2-MP90 Versions N and prior, IntelliVue X3 and X2 Versions N and prior.
What is the vulnerability type of CVE-2020-16228?
The vulnerability type of CVE-2020-16228 is CWE-299.
How can I fix CVE-2020-16228?
To fix CVE-2020-16228, it is recommended to update to the latest version of the affected software or apply the necessary patches and mitigations recommended by the vendor.
- agent/type
- agent/references
- agent/event
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/title
- agent/last-modified-date
- agent/remedy
- agent/description
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/philips
- canonical/philips patient information center ix
- version/philips patient information center ix/b.02
- version/philips patient information center ix/c.02
- version/philips patient information center ix/c.03
- canonical/philips performancebridge focal point
- version/philips performancebridge focal point/a.01
- canonical/philips intellivue np90 firmware
- canonical/philips intellivue mp2-mp90 firmware
- version/philips intellivue mp2-mp90 firmware/n
- canonical/philips intellivue mx100 firmware
- canonical/philips intellivue mx400 firmware
- canonical/philips intellivue mx850 firmware
- canonical/philips intellivue x2 firmware
- version/philips intellivue x2 firmware/n
- canonical/philips intellivue x3 firmware
- version/philips intellivue x3 firmware/n
- canonical/philips intellivue mp monitors mx800/700/600 firmware
- canonical/philips intellivue mx800 firmware
- canonical/philips intellivue mx750 firmware
- canonical/philips intellivue mx600 firmware
- canonical/philips intellivue mx550
- canonical/philips intellivue mx550 firmware