CVE-2020-16228 — MEDIUM (6.4)

Vulnerability Description

In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a compromised certificate.

CVSS Score

6.4

MEDIUM

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

HIGH

Availability

LOW

Affected Products

Vendor	Product	Versions
Philips	Patient Information Center Ix	b.02
Philips	Performancebridge Focal Point	a.01
Philips	Intellivue Mp2-Mp90 Firmware	-
Philips	Intellivue Mp2-Mp90	n
Philips	Intellivue Mx100 Firmware	-
Philips	Intellivue Mx100	-
Philips	Intellivue Mx400 Firmware	-
Philips	Intellivue Mx400	-
Philips	Intellivue Mx850 Firmware	-
Philips	Intellivue Mx850	-
Philips	Intellivue X2 Firmware	-
Philips	Intellivue X2	n
Philips	Intellivue X3 Firmware	-
Philips	Intellivue X3	n
Philips	Intellivue Mx800 Firmware	-
Philips	Intellivue Mx800	-
Philips	Intellivue Mx750 Firmware	-
Philips	Intellivue Mx750	-
Philips	Intellivue Mx700 Firmware	-
Philips	Intellivue Mx700	-

Related Weaknesses (CWE)

CWE-299

References

https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party AdvisoryUS Government Resource
https://www.philips.com/productsecurity
https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party AdvisoryUS Government Resource
https://www.philips.com/productsecurity

FAQ

What is CVE-2020-16228?

CVE-2020-16228 is a vulnerability with a CVSS score of 6.4 (MEDIUM). In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions ...

How severe is CVE-2020-16228?

CVE-2020-16228 has been rated MEDIUM with a CVSS base score of 6.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2020-16228?

Check the references section above for vendor advisories and patch information. Affected products include: Philips Patient Information Center Ix, Philips Performancebridge Focal Point, Philips Intellivue Mp2-Mp90 Firmware, Philips Intellivue Mp2-Mp90, Philips Intellivue Mx100 Firmware.