Medium severity · published Sep 11, 2020
CVE-2020-16216
In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and prior, the product receives input or data…
6.5
CVSS
0.7%
EPSS
No
On KEV
Description
In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750,
MX800, MX850, MP2-MP90, and IntelliVue X2 and X3 Versions N and prior,
the product receives input or data but does not validate or incorrectly
validates that the input has the properties required to process the data
safely and correctly, which can induce a denial-of-service condition
through a system restart.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IM
Intellivue Mp2-mp90 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx100 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx400 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx550 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx600 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx700 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx750 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx800 Firmware · Philips
All versions, or not specified · source: NVD
IM
Intellivue Mx850 Firmware · Philips
All versions, or not specified · source: NVD
IX
Intellivue X2 Firmware · Philips
All versions, or not specified · source: NVD
IX
Intellivue X3 Firmware · Philips
All versions, or not specified · source: NVD
PI
Patient Information Center IX · Philips
b.02; c.02; c.03 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-16216
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-16216
Third Party Advisory
https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01
www.philips.com
https://www.philips.com/productsecurity
More from Intellivue Mp2-mp90 Firmware
6.4
CVE-2020-16228
In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and…