CVE-2020-16220 — MEDIUM (4.3)

Vulnerability Description

In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certain syntax) but it does not validate or incorrectly validates that the input complies with the syntax, causing the certificate enrollment service to crash. It does not impact monitoring but prevents new devices from enrolling.

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

NONE

Integrity

NONE

Availability

LOW

Affected Products

Vendor	Product	Versions
Philips	Patient Information Center Ix	b.02
Philips	Performancebridge Focal Point	a.01

Related Weaknesses (CWE)

CWE-1286

References

https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party AdvisoryUS Government Resource
https://www.philips.com/productsecurity
https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party AdvisoryUS Government Resource
https://www.philips.com/productsecurity

FAQ

What is CVE-2020-16220?

CVE-2020-16220 is a vulnerability with a CVSS score of 4.3 (MEDIUM). In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certai...

How severe is CVE-2020-16220?

CVE-2020-16220 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-16220?

Check the references section above for vendor advisories and patch information. Affected products include: Philips Patient Information Center Ix, Philips Performancebridge Focal Point.