CVE-2020-16220
lowpriority · track · 17EPSS 0.003 · 20 %ileEUUSEPSS · scored 2026-10-27
In Patient Information Center iX (PICiX) Versions C.02, C.03, PerformanceBridge Focal Point Version A.01, the product receives input that is expected to be well-formed (i.e., to comply with a certain syntax) but it does not validate or incorrectly validates that the input complies with the syntax, causing the certificate enrollment service to crash. It does not impact monitoring but prevents new devices from enrolling.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
A vendor fix is available.
- FixedIntelliVue patient monitor MP2-MP90cisa_csaf_ot
IntelliVue Patient Monitors Versions N.00 and N.01
- FixedIntelliVue patient monitor MX100cisa_csaf_ot
IntelliVue Patient Monitors Versions N.00 and N.01
- FixedIntelliVue patient monitor MX400-MX850cisa_csaf_ot
IntelliVue Patient Monitors Versions N.00 and N.01
- FixedPatient Information Center iX (PICiX)cisa_csaf_ot
Patient Information Center iX (PICiX) Version C.03
- FixedPerformanceBridge Focal Pointcisa_csaf_ot
PerformanceBridge Focal Point
- MitigationIntelliVue X2cisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
- MitigationIntelliVue X3cisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
- MitigationIntelliVue patient monitor MP2-MP90cisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
- MitigationIntelliVue patient monitor MX100cisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
- MitigationIntelliVue patient monitor MX400-MX850cisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
- MitigationPatient Information Center iX (PICiX)cisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
- MitigationPerformanceBridge Focal Pointcisa_csaf_ot
As a mitigation to these vulnerabilities, Philips recommends the following:
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.3–4.3
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (23)
Products and version ranges known to be affected.
- philips patient information center ix= b.02nvdUScpe:2.3:a:philips:patient_information_center_ix:*:*:*:*:*:*:*:*
advisories (1)
Vendor and ecosystem advisories describing this.
- ICSMA-20-254-01Philips Patient Monitoring Devices (Update C)2020-09-10icsa · cisa_csaf_otUS
Successful exploitation of these vulnerabilities could result in unauthorized access, interrupted monitoring, and collection of access information and/or patient data. To successfully exploit these vulnerabilities, an attacker would need to gain either physical access to surveillance stations and patient monitors or access to the medical device network.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (9)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2020-16220cnnvd
- https://nvd.nist.gov/vuln/detail/CVE-2020-16220cnnvd
- https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01cnnvd
- https://www.auscert.org.au/bulletins/ESB-2020.3140/cnnvd
- https://www.philips.com/productsecuritycnnvd
- https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01enisa_euvd
- https://www.philips.com/productsecurityenisa_euvd
- https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party AdvisoryUS Government Resourcenvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan