Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of Input
CVE-2020-16220

4.3MEDIUM

Key Information:

Vendor: Philips
Status: Patient Information Center Ix (picix); Performancebridge Focal Point
Vendor: CVE Published:; 11 September 2020

Summary

In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certain syntax) but it does not validate or incorrectly validates that the input complies with the syntax, causing the certificate enrollment service to crash. It does not impact monitoring but prevents new devices from enrolling.

Affected Version(s)

Patient Information Center iX (PICiX) C.02

Patient Information Center iX (PICiX) C.03

PerformanceBridge Focal Point A.01

References

https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01

x_refsource_MISC

https://www.philips.com/productsecurity

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

None

Integrity:

None

Availability:

None

Attack Vector:

Adjacent Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Sep 11, 2020
Vulnerability Reserved
Jul 31, 2020

Credit

Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips.