CVE-2020-16222 : Vulnerability Insights and Analysis

Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, PerformanceBridge Focal Point Version A.01, and IntelliVue patient monitors MX100, MX400-MX850, MP2-MP90 Versions N and prior, X3, and X2 are affected by an improper authentication vulnerability.

Understanding CVE-2020-16222

This CVE involves vulnerabilities in Philips patient monitoring devices due to improper authentication.

What is CVE-2020-16222?

In PICiX and PerformanceBridge Focal Point versions, the software fails to adequately verify the identity claimed by an actor, leading to potential security risks.

The Impact of CVE-2020-16222

The vulnerability could allow unauthorized actors to access patient monitoring systems, compromising patient data confidentiality and system integrity.

Technical Details of CVE-2020-16222

This section provides detailed technical information about the vulnerability.

Vulnerability Description

The software in affected versions does not sufficiently verify the claimed identity, leaving systems vulnerable to unauthorized access.

Affected Systems and Versions

Patient Information Center iX (PICiX) Versions B.02, C.02, C.03
PerformanceBridge Focal Point Version A.01
IntelliVue patient monitors MX100, MX400-MX850, MP2-MP90 Versions N and prior, X3, and X2

Exploitation Mechanism

Unauthorized actors can exploit the lack of proper authentication to gain unauthorized access to the patient monitoring devices.

Mitigation and Prevention

Learn how to mitigate and prevent the CVE-2020-16222 vulnerability.

Immediate Steps to Take

Isolate the patient monitoring network from the hospital LAN using firewalls or routers with access control lists.
Ensure the simple certificate enrollment protocol (SCEP) service is only active when necessary.
Use unique challenge passwords when enrolling new devices via SCEP.
Implement physical security controls to prevent unauthorized access.
Restrict remote access to PIC iX servers to essential needs.
Grant login privileges based on roles and least privilege principles.

Long-Term Security Practices

Maintain physical security of servers and equipment.
Regularly review and update security protocols.
Educate staff on security best practices.

Patching and Updates

Philips released remediation versions, including PICiX Version C.03 and PerformanceBridge Focal Point.
Certificate revocation was implemented for PIC iX and Performance Bridge FocalPoint.