Improper Check for Certificate Revocation in Philips products - CVE-2020-16228

Vulnerability identifier: #VU46649

CSH Severity: Low

CVSS v4: 7.3 [CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-16228

CWE-ID: CWE-299

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows a remote user to compromise the target system.

The vulnerability exists due to the affected software does not check or incorrectly checks the revocation status of a certificate. A remote administrator on the local network can compromise certificate.

IntelliVue patient monitors MX450
IntelliVue X3
IntelliVue patient monitors MX750
IntelliVue patient monitors MX850
IntelliVue patient monitors MX550
IntelliVue patient monitors MX500
IntelliVue patient monitors MX430
IntelliVue patient monitors MX400
IntelliVue patient monitors MX100
Patient Information Center iX

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

• https://ics-cert.us-cert.gov/advisories/icsma-20-254-01

• Multiple vulnerabilities in Philips Patient Monitoring Devices