Medium severity · published Sep 11, 2020
CVE-2020-16214
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the software saves user-provided information into a comma-separated value (CSV) file, but it does not…
5.0
CVSS
0.6%
EPSS
No
On KEV
Description
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the
software saves user-provided information into a comma-separated value
(CSV) file, but it does not neutralize or incorrectly neutralizes
special elements that could be interpreted as a command when the file is
opened by spreadsheet software.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 48% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PI
Patient Information Center IX · Philips
b.02; c.02; c.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16214
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16214
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01
www.philips.com
https://www.philips.com/productsecurity
More from Patient Information Center IX
8.8
CVE-2020-16222
In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01, when an actor claims to have a given identity, the software…
6.8
CVE-2020-16212
In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate…
6.5
CVE-2021-43550
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information, which affects the communications between…
6.5
CVE-2021-43548
Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or incorrectly validates that the input has the properties required to…
6.5
CVE-2020-16224
In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that…