CVE-2020-16212
Last modified
CVE-2020-16212 is a medium-severity vulnerability rated 6.8/10 on the CVSS scale. In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges.. EPSS estimates a 0.37% chance of exploitation in the next 30 days.
Description
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges.
Metrics
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Philips | Patient Information Center Ix | b.02 |
| Philips | Patient Information Center Ix | c.02 |
| Philips | Patient Information Center Ix | c.03 |
References
- https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party Advisory, US Government Resource
- https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01Third Party Advisory, US Government Resource
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-16212?
How severe is CVE-2020-16212?
How do I fix CVE-2020-16212?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-16207Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prio…7.8
- CVE-2020-16208The affected product is vulnerable to cross-site request for…8.8
- CVE-2020-16209A malicious attacker could exploit the interface of the Fiel…9.8
- CVE-2020-1621A local, authenticated user with shell can obtain the hashed…5.5
- CVE-2020-16210The affected product is vulnerable to reflected cross-site s…9
- CVE-2020-16211Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prio…5.5
- CVE-2020-16213Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prio…7.8
- CVE-2020-16214In Patient Information Center iX (PICiX) Versions B.02, C.02…5
- CVE-2020-16215Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prio…7.8
- CVE-2020-16216In IntelliVue patient monitors MX100, MX400-550, MX600, MX70…6.5
- CVE-2020-16217Advantech WebAccess HMI Designer, Versions 2.1.9.31 and prio…7.8
- CVE-2020-16218In Patient Information Center iX (PICiX) Versions B.02, C.02…3.5
Are you affected by CVE-2020-16212?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST