ID
VAR-202009-0606
CVE
CVE-2020-16220
TITLE
Patient Information Security hole
Trust: 0.6
DESCRIPTION
In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certain syntax) but it does not validate or incorrectly validates that the input complies with the syntax, causing the certificate enrollment service to crash. It does not impact monitoring but prevents new devices from enrolling. A vulnerability exists in Patient Information. The vulnerability stems from special elements that may be interpreted as commands when spreadsheet software opens the file. The following products and versions are affected: B.02, C.02, C.03. Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX850, and MP2-MP90 Versions N and prior, IntelliVue X3 and X2 Versions N and prior
Trust: 1.08
AFFECTED PRODUCTS
| vendor: | philips | model: | performancebridge focal point | scope: | eq | version: | a.01 | Trust: 1.0 |
| vendor: | philips | model: | patient information center ix | scope: | eq | version: | c.03 | Trust: 1.0 |
| vendor: | philips | model: | patient information center ix | scope: | eq | version: | c.02 | Trust: 1.0 |
| vendor: | philips | model: | patient information center ix | scope: | eq | version: | b.02 | Trust: 1.0 |
CVSS
SEVERITY | CVSSV2 | CVSSV3 | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
|
PROBLEMTYPE DATA
| problemtype: | CWE-1286 | Trust: 1.0 |
THREAT TYPE
remote or local
Trust: 0.6
TYPE
other
Trust: 0.6
PATCH
| title: | Patient Information Security vulnerabilities | url: | http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=128118 | Trust: 0.6 |
EXTERNAL IDS
| db: | NVD | id: | CVE-2020-16220 | Trust: 1.8 |
| db: | ICS CERT | id: | ICSMA-20-254-01 | Trust: 1.8 |
| db: | CNNVD | id: | CNNVD-202009-675 | Trust: 0.7 |
| db: | AUSCERT | id: | ESB-2020.3140 | Trust: 0.6 |
| db: | VULHUB | id: | VHN-169277 | Trust: 0.1 |
| db: | VULMON | id: | CVE-2020-16220 | Trust: 0.1 |
REFERENCES
| url: | https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 | Trust: 2.4 |
| url: | https://www.philips.com/productsecurity | Trust: 1.0 |
| url: | https://www.auscert.org.au/bulletins/esb-2020.3140/ | Trust: 0.6 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2020-16220 | Trust: 0.6 |
| url: | https://cwe.mitre.org/data/definitions/1286.html | Trust: 0.1 |
| url: | https://nvd.nist.gov | Trust: 0.1 |
CREDITS
in the context of the BSI project ManiMed (Manipulation of medical devices), Germany,Julian Suleder, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Dr. Oliver Matula of ERNW Enno, which reported these to Philips., Nils Emmerich, Birk Kauer of ERNW Research GmbH
Trust: 0.6
SOURCES
| db: | VULHUB | id: | VHN-169277 |
| db: | VULMON | id: | CVE-2020-16220 |
| db: | CNNVD | id: | CNNVD-202009-675 |
| db: | NVD | id: | CVE-2020-16220 |
LAST UPDATE DATE
2024-08-14T13:43:56.119000+00:00
SOURCES UPDATE DATE
| db: | VULHUB | id: | VHN-169277 | date: | 2020-09-15T00:00:00 |
| db: | VULMON | id: | CVE-2020-16220 | date: | 2020-09-15T00:00:00 |
| db: | CNNVD | id: | CNNVD-202009-675 | date: | 2021-09-01T00:00:00 |
| db: | NVD | id: | CVE-2020-16220 | date: | 2023-12-12T21:15:07.717 |
SOURCES RELEASE DATE
| db: | VULHUB | id: | VHN-169277 | date: | 2020-09-11T00:00:00 |
| db: | VULMON | id: | CVE-2020-16220 | date: | 2020-09-11T00:00:00 |
| db: | CNNVD | id: | CNNVD-202009-675 | date: | 2020-09-10T00:00:00 |
| db: | NVD | id: | CVE-2020-16220 | date: | 2020-09-11T14:15:11.503 |