CVE-2020-16220 : What You Need to Know

Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, PerformanceBridge Focal Point Version A.01, and IntelliVue patient monitors are affected by improper validation of syntactic correctness of input, leading to vulnerabilities reported by security researchers.

Understanding CVE-2020-16220

This CVE involves vulnerabilities in Philips' patient monitoring devices due to improper validation of input syntax, impacting the certificate enrollment service.

What is CVE-2020-16220?

The affected products receive input that is expected to be well-formed but fail to validate or incorrectly validate the input, causing the certificate enrollment service to crash. This issue does not affect monitoring but prevents new devices from enrolling.

The Impact of CVE-2020-16220

The vulnerability can disrupt the certificate enrollment service, potentially hindering the onboarding of new devices to the network.

Technical Details of CVE-2020-16220

This section provides more in-depth technical insights into the vulnerability.

Vulnerability Description

The vulnerability arises from the products' inability to properly validate input syntax, leading to service crashes.

Affected Systems and Versions

Patient Information Center iX (PICiX) Versions C.02, C.03
PerformanceBridge Focal Point Version A.01

Exploitation Mechanism

The issue occurs when the products receive malformed input that is not correctly validated, causing the certificate enrollment service to malfunction.

Mitigation and Prevention

Steps to address and prevent the vulnerabilities in Philips' patient monitoring devices.

Immediate Steps to Take

Isolate the patient monitoring network from the hospital LAN using firewalls or routers with access control lists.
Ensure the simple certificate enrollment protocol (SCEP) service is only active when necessary.
Use unique challenge passwords for device enrollment.
Implement physical security controls to prevent unauthorized access.
Restrict remote access and grant login privileges based on roles.

Long-Term Security Practices

Maintain strict access controls and monitoring of equipment.
Regularly update and patch the systems to address security vulnerabilities.

Patching and Updates

Philips released remediation versions, including PICiX Version C.03 and PerformanceBridge Focal Point with certificate revocation implemented.
Refer to the Philips product security website for the latest security information.