PT-2020-14813 · Philips · Patient Information Center Ix

Published 2020-09-11 · Updated 2023-12-12 · CVE-2020-16214

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Patient Information Center iX (PICiX) versions B.02, C.02, C.03

Description The software saves user-provided information into a comma-separated value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software.

Recommendations For versions B.02, C.02, C.03, consider disabling the feature that saves user-provided information into CSV files until a patch is available. Restrict access to the CSV files generated by the software to minimize the risk of exploitation. Avoid opening CSV files generated by the software in spreadsheet software until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-1236

Related Identifiers

CVE-2020-16214

Affected Products

Patient Information Center Ix

References · 5

• https://osv.dev/vulnerability/CVE-2020-16214 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16214 · Security Note
• https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01 · Note
• https://t.me/cvenotify/63346 · Telegram Post
• https://philips.com/productsecurity · Note