CVE-2020-16212
Vulnerability from cvelistv5
Published
2020-09-11 13:13
Modified
2024-08-04 13:37
Severity ?
Summary
Philips Patient Monitoring Devices Exposure of Resource to Wrong Sphere
References
ics-cert@hq.dhs.govhttps://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party Advisory, US Government Resource
ics-cert@hq.dhs.govhttps://www.philips.com/productsecurity
Impacted products
PhilipsPatient Information Center iX (PICiX)
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T13:37:54.079Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.philips.com/productsecurity"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Patient Information Center iX (PICiX)",
          "vendor": "Philips",
          "versions": [
            {
              "status": "affected",
              "version": "B.02"
            },
            {
              "status": "affected",
              "version": "C.02"
            },
            {
              "status": "affected",
              "version": "C.03"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "user": "00000000-0000-4000-9000-000000000000",
          "value": "Julian Suleder, Nils Emmerich, Birk Kauer of ERNW Research GmbH, Dr. Oliver Matula of ERNW Enno, and Rey Netzwerke GmbH reported these vulnerabilities to the Federal Office for Information Security (BSI), Germany, in the context of the BSI project ManiMed (Manipulation of medical devices), which reported these to Philips."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges."
            }
          ],
          "value": "In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-668",
              "description": "CWE-668 Exposure of Resource to Wrong Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-12T18:24:53.053Z",
        "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
        "shortName": "icscert"
      },
      "references": [
        {
          "url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01"
        },
        {
          "url": "https://www.philips.com/productsecurity"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Philips released the following versions to remediate reported vulnerabilities:\u003cbr\u003e\u003cbr\u003e* Patient Information Center iX (PICiX) Version C.03\u003cbr\u003e* Certificate revocation within the system was implemented for PIC iX and Performance Bridge FocalPoint in 2023. The implementation of the IntelliVue Patient Monitors will be completed in Q3 of 2024.\u003cbr\u003e"
            }
          ],
          "value": "Philips released the following versions to remediate reported vulnerabilities:\n\n* Patient Information Center iX (PICiX) Version C.03\n* Certificate revocation within the system was implemented for PIC iX and Performance Bridge FocalPoint in 2023. The implementation of the IntelliVue Patient Monitors will be completed in Q3 of 2024.\n"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Philips Patient Monitoring Devices Exposure of Resource to Wrong Sphere",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "As a mitigation to these vulnerabilities, Philips recommends the following:\u003cbr\u003e* The Philips patient monitoring network is required to be physically or logically isolated from the hospital local area network (LAN). Philips recommends using a firewall or routers that can implement access control lists restricting access in and out of the patient monitoring network for only necessary ports and IP addresses. Refer to the Philips Patient Monitoring System Security for Clinical Networks guide for additional information on [InCenter](\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://incenter.medical.philips.com/)\"\u003ehttps://incenter.medical.philips.com/)\u003c/a\u003e.\u003cbr\u003e* By default, the simple certificate enrollment protocol (SCEP) service is not running. When needed, the service is configured to run based on the duration or the number of certificates to be assigned. One certificate is default, but if a certificate is not issued, the service will continue to run. Limit exposure by ensuring the SCEP service is not running unless it is actively being used to enroll new devices.\u003cbr\u003e* When enrolling new devices using SCEP, enter a unique challenge password of 8-12 unpredictable and randomized digits.\u003cbr\u003e* Implement physical security controls to prevent unauthorized login attempts on the PIC iX application. Servers should be kept in controlled locked data centers. Access to equipment at nurses\u2019 stations should be controlled and monitored.\u003cbr\u003e* Only grant remote access to PIC iX servers on a must-have basis.\u003cbr\u003e* Grant login privileges to the bedside monitor and PIC iX application on a role-based, least-privilege basis, and only to trusted users.\u003cbr\u003e \u003cbr\u003eUsers with questions regarding their specific Philips Patient Information Center (PIC iX) and/or IntelliVue patient monitor installations and new release eligibility should contact their local Philips service support team, or regional service support (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.usa.philips.com/healthcare/solutions/customer-service-solutions\"\u003ehttps://www.usa.philips.com/healthcare/solutions/customer-service-solutions\u003c/a\u003e), or call 1-800-722-9377.\u003cbr\u003e\u003cbr\u003ePlease see the Philips product security website (\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://www.philips.com/productsecurity\"\u003ehttps://www.philips.com/productsecurity\u003c/a\u003e) for the Philips advisory and the latest security information for Philips products.\u003cbr\u003e"
            }
          ],
          "value": "As a mitigation to these vulnerabilities, Philips recommends the following:\n* The Philips patient monitoring network is required to be physically or logically isolated from the hospital local area network (LAN). Philips recommends using a firewall or routers that can implement access control lists restricting access in and out of the patient monitoring network for only necessary ports and IP addresses. Refer to the Philips Patient Monitoring System Security for Clinical Networks guide for additional information on [InCenter]( https://incenter.medical.philips.com/) https://incenter.medical.philips.com/) .\n* By default, the simple certificate enrollment protocol (SCEP) service is not running. When needed, the service is configured to run based on the duration or the number of certificates to be assigned. One certificate is default, but if a certificate is not issued, the service will continue to run. Limit exposure by ensuring the SCEP service is not running unless it is actively being used to enroll new devices.\n* When enrolling new devices using SCEP, enter a unique challenge password of 8-12 unpredictable and randomized digits.\n* Implement physical security controls to prevent unauthorized login attempts on the PIC iX application. Servers should be kept in controlled locked data centers. Access to equipment at nurses\u2019 stations should be controlled and monitored.\n* Only grant remote access to PIC iX servers on a must-have basis.\n* Grant login privileges to the bedside monitor and PIC iX application on a role-based, least-privilege basis, and only to trusted users.\n \nUsers with questions regarding their specific Philips Patient Information Center (PIC iX) and/or IntelliVue patient monitor installations and new release eligibility should contact their local Philips service support team, or regional service support ( https://www.usa.philips.com/healthcare/solutions/customer-service-solutions https://www.usa.philips.com/healthcare/solutions/customer-service-solutions ), or call 1-800-722-9377.\n\nPlease see the Philips product security website ( https://www.philips.com/productsecurity https://www.philips.com/productsecurity ) for the Philips advisory and the latest security information for Philips products.\n"
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "ics-cert@hq.dhs.gov",
          "ID": "CVE-2020-16212",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Philips Patient Information Center iX (PICiX), PerformanceBridge Focal Point, IntelliVue patient monitors MX100, MX400-MX850, and MP2-MP90, IntelliVue X3 and X2.",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX850, and MP2-MP90 Versions N and prior, IntelliVue X3 and X2 Versions N and prior."
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX850, and MP2-MP90 Versions N and prior, IntelliVue X3 and X2 Versions N and prior. The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "EXPOSURE OF RESOURCE TO WRONG SPHERE CWE-668"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01",
              "refsource": "MISC",
              "url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
    "assignerShortName": "icscert",
    "cveId": "CVE-2020-16212",
    "datePublished": "2020-09-11T13:13:35",
    "dateReserved": "2020-07-31T00:00:00",
    "dateUpdated": "2024-08-04T13:37:54.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2020-16212\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2020-09-11T14:15:11.377\",\"lastModified\":\"2023-12-12T19:15:07.597\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges.\"},{\"lang\":\"es\",\"value\":\"Patient Information Center iX (PICiX) Versiones B.02, C.02, C.03, PerformanceBridge Focal Point Versi\u00f3n A.01, Monitores de paciente IntelliVue MX100, MX400-MX850 y MP2-MP90 Versiones N y anteriores, IntelliVue X3 y X2 Versiones N y anteriores.\u0026#xa0;El producto expone un recurso a la esfera de control equivocada, proporcionando a los actores no deseados un acceso inapropiado al recurso.\u0026#xa0;La aplicaci\u00f3n en la estaci\u00f3n de supervisi\u00f3n opera en modo Kiosk, que es vulnerable a filtraciones locales que podr\u00edan permitir a un atacante con acceso f\u00edsico escapar el entorno restringido con privilegios limitados\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"PHYSICAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":6.8,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":0.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":4.6},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]},{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:philips:patient_information_center_ix:b.02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C4FA1FEC-5139-48C1-856C-8062436AE6C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:philips:patient_information_center_ix:c.02:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F3220AB2-AC0D-4AC2-90D8-76C02FC693EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:philips:patient_information_center_ix:c.03:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE1FB3E9-E269-434A-B1C2-D54C40F437BE\"}]}]}],\"references\":[{\"url\":\"https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.philips.com/productsecurity\",\"source\":\"ics-cert@hq.dhs.gov\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.