PT-2020-14811 · Philips · Patient Information Center Ix

Published 2020-09-11 · Updated 2023-12-12 · CVE-2020-16212

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Patient Information Center iX (PICiX) versions B.02, C.02, C.03

Description The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges.

Recommendations For versions B.02, C.02, C.03, consider restricting access to the resource and implementing additional security measures to prevent local breakouts and unauthorized access. As a temporary workaround, consider disabling the kiosk mode on the surveillance station until a patch is available. Restrict physical access to the surveillance station to minimize the risk of exploitation.

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2020-16212

Affected Products

Patient Information Center Ix

References · 5

• https://osv.dev/vulnerability/CVE-2020-16212 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16212 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 · Note
• https://t.me/cvenotify/63309 · Telegram Post
• https://philips.com/productsecurity · Note