Multiple vulnerabilities in Philips Patient Monitoring Devices

1) CSV Injection

EUVDB-ID: #VU46646

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16214

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

Exploit availability: No

Description

The vulnerability allows a local user to inject arbitrary data into CSV files.

The vulnerability exists due to improper input validation when generating CSV files. A local administrator can create specially crafted CSV files and trick the victim into exporting the file with malicious content.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: B.02 - C.03

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU46647

Risk: Low

CVSSv3.1: 4.4 [CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16218

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to insufficient sanitization of user-supplied data. A remote authenticated attacker on the local network can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: B.02 - C.03

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper Authentication

EUVDB-ID: #VU46648

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16222

CWE-ID: CWE-287 - Improper Authentication

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass authentication process.

The vulnerability exists due to an error in when processing authentication requests. A remote attacker on the local network can bypass authentication process and gain unauthorized access to the application.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: B.02 - C.03

PerformanceBridge Focal Point: A.01

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improper Check for Certificate Revocation

EUVDB-ID: #VU46649

Risk: Low

CVSSv3.1: 5.5 [CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16228

CWE-ID: CWE-299 - Improper Check for Certificate Revocation

Exploit availability: No

Description

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to the affected software does not check or incorrectly checks the revocation status of a certificate. A remote administrator on the local network can compromise certificate.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: B.02 - C.03

IntelliVue patient monitors MX100: N

IntelliVue patient monitors MX400: N

IntelliVue patient monitors MX430: N

IntelliVue patient monitors MX450: N

IntelliVue patient monitors MX500: N

IntelliVue patient monitors MX550: N

IntelliVue patient monitors MX850: N

IntelliVue patient monitors MX750: N

IntelliVue X3: N

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Improper Handling of Length Parameter Inconsistency

EUVDB-ID: #VU46650

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16224

CWE-ID: CWE-130 - Improper Handling of Length Parameter Inconsistency

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to the affected software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data. A remote attacker on the local network can cause the application on the surveillance station to restart.  

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: C.02 - C.03

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Input validation error

EUVDB-ID: #VU46651

Risk: Low

CVSSv3.1: 3.2 [CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16220

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper validation of syntactic correctness of input. A remote attacker on the local network can pass specially crafted input to the application and crash the certificate enrollment service.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: C.02 - C.03

PerformanceBridge Focal Point: A.01

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Input validation error

EUVDB-ID: #VU46652

Risk: Low

CVSSv3.1: 6 [CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16216

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker on the local network can pass specially crafted input to the application and perform a denial of service (DoS) attack.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

IntelliVue patient monitors MX100: N

IntelliVue patient monitors MX400: N

IntelliVue patient monitors MX430: N

IntelliVue patient monitors MX450: N

IntelliVue patient monitors MX500: N

IntelliVue patient monitors MX550: N

IntelliVue patient monitors MX600: N

IntelliVue patient monitors MX700: N

IntelliVue patient monitors MX750: N

IntelliVue patient monitors MX800: N

IntelliVue patient monitors MX850: N

IntelliVue patient monitors MP2: N

IntelliVue patient monitors MP5: N

IntelliVue patient monitors MP20: N

IntelliVue patient monitors MP30: N

IntelliVue patient monitors MP40: N

IntelliVue patient monitors MP50: N

IntelliVue patient monitors MP60: N

IntelliVue patient monitors MP70: N

IntelliVue patient monitors MP80: N

IntelliVue patient monitors MP90: N

IntelliVue X3: N

IntelliVue X2: N

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Exposure of Resource to Wrong Sphere

EUVDB-ID: #VU46653

Risk: Low

CVSSv3.1: 6.2 [CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:U/RC:C]

CVE-ID: CVE-2020-16212

CWE-ID: N/A

Exploit availability: No

Description

The vulnerability allows a local attacker to compromise the target system.

The vulnerability exists due to the affected product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. An attacker with physical access can escape the restricted environment with limited privileges.

Mitigation

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

Vulnerable software versions

Patient Information Center iX: B.02 - C.03

External links

http://ics-cert.us-cert.gov/advisories/icsma-20-254-01

Q & A

Can this vulnerability be exploited remotely?

No. The attacker should have physical access to the system in order to successfully exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.