CVE-2020-16220: vulnerability in Philips Patient Information Center iX (PICiX)
Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of Input
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.3%
In Patient Information Center iX (PICiX) Versions C.02, C.03,
PerformanceBridge Focal Point Version A.01, the product receives input
that is expected to be well-formed (i.e., to comply with a certain
syntax) but it does not validate or incorrectly validates that the input
complies with the syntax, causing the certificate enrollment service to
crash. It does not impact monitoring but prevents new devices from
enrolling.
Affected products
Philips · Patient Information Center iX (PICiX)Philips · PerformanceBridge Focal PointRelated CVEs — Philips Patient Information Center iX (PICiX)
In the same product, most dangerous first.
CVE-2020-16218—Philips Patient Monitoring Devices Cross-site ScriptingEPSS 0.7%CVE-2020-16224—Philips Patient Monitoring Devices Improper Handling of Length Parameter InconsistencyEPSS 0.6%CVE-2020-16214—Philips Patient Monitoring Devices Improper Neutralization of Formula Elements in a CSV FileEPSS 0.6%CVE-2020-16222—Philips Patient Monitoring Devices Improper AuthenticationEPSS 0.5%CVE-2020-16212—Philips Patient Monitoring Devices Exposure of Resource to Wrong SphereEPSS 0.4%CVE-2020-16228—Philips Patient Monitoring Devices Improper Check for Certificate RevocationEPSS 0.4%