CVE-2020-16220 Philips Patient Monitoring Devices Improper Validation of Syntactic Correctness of Input

2020-09-1113:11:22

CWE-1286

icscert

www.cve.org

4.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

27.1%

JSON

In Patient Information Center iX (PICiX) Versions C.02, C.03,
PerformanceBridge Focal Point Version A.01, the product receives input
that is expected to be well-formed (i.e., to comply with a certain
syntax) but it does not validate or incorrectly validates that the input
complies with the syntax, causing the certificate enrollment service to
crash. It does not impact monitoring but prevents new devices from
enrolling.

CNA Affected

[
  {
    "defaultStatus": "unaffected",
    "product": "Patient Information Center iX (PICiX)",
    "vendor": "Philips ",
    "versions": [
      {
        "status": "affected",
        "version": "C.02"
      },
      {
        "status": "affected",
        "version": "C.03"
      }
    ]
  },
  {
    "defaultStatus": "unaffected",
    "product": "PerformanceBridge Focal Point",
    "vendor": "Philips ",
    "versions": [
      {
        "status": "affected",
        "version": "A.01"
      }
    ]
  }
]