CVE-2020-16224

In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data, causing the application on the surveillance station to restart.

CVSS v3 6.5 MEDIUM
CVSS v2.0 3.3 LOW

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

3.3^/10

CVSS v2.0 : LOW

Vector : AV:A/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 6.5 / Impact : 2.9

Access Vector ADJACENT_NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01	Third Party Advisory US Government Resource
https://www.philips.com/productsecurity

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:philips:patient_information_center_ix:c.02:::::::*
	cpe:2.3:a:philips:patient_information_center_ix:c.03:::::::*

History

No history.

Information

Published : 2020-09-11 14:15

Updated : 2023-12-12 21:15

NVD link : CVE-2020-16224

Mitre link : CVE-2020-16224

CVE.ORG link : CVE-2020-16224

JSON object : View

Products Affected

philips

patient_information_center_ix

CWE

CWE-130

Improper Handling of Length Parameter Inconsistency

{"id": "CVE-2020-16224", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.3, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:L/Au:N/C:N/I:N/A:P", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 2.8}]}, "published": "2020-09-11T14:15:11.567", "references": [{"url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.philips.com/productsecurity", "source": "ics-cert@hq.dhs.gov"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-130"}]}], "descriptions": [{"lang": "en", "value": "In Patient Information Center iX (PICiX) Versions C.02, C.03, the \nsoftware parses a formatted message or structure but does not handle or \nincorrectly handles a length field that is inconsistent with the actual \nlength of the associated data, causing the application on the \nsurveillance station to restart.\n\n\n\n"}, {"lang": "es", "value": "Patient Information Center iX (PICiX) Versiones B.02, C.02, C.03, PerformanceBridge Focal Point Versi\u00f3n A.01, monitores de paciente IntelliVue MX100, MX400-MX850 y MP2-MP90 Versiones N y anteriores, IntelliVue X3 y X2 Versiones N y anteriores. El software analiza una estructura o mensaje formateado, pero no maneja o maneja incorrectamente un campo de longitud que no es consistente con la longitud real de los datos asociados, causando que la aplicaci\u00f3n en la estaci\u00f3n de supervisi\u00f3n se reinicie"}], "lastModified": "2023-12-12T21:15:07.887", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:philips:patient_information_center_ix:c.02:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F3220AB2-AC0D-4AC2-90D8-76C02FC693EB"}, {"criteria": "cpe:2.3:a:philips:patient_information_center_ix:c.03:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AE1FB3E9-E269-434A-B1C2-D54C40F437BE"}], "operator": "OR"}]}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}