nvd-json-data-feeds/CVE-2020/CVE-2020-162xx/CVE-2020-16212.json

{
  "id": "CVE-2020-16212",
  "sourceIdentifier": "ics-cert@hq.dhs.gov",
  "published": "2020-09-11T14:15:11.377",
  "lastModified": "2023-12-12T19:15:07.597",
  "vulnStatus": "Modified",
  "descriptions": [
    {
      "lang": "en",
      "value": "In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource. The application on the surveillance station operates in kiosk mode, which is vulnerable to local breakouts that could allow an attacker with physical access to escape the restricted environment with limited privileges."
    },
    {
      "lang": "es",
      "value": "Patient Information Center iX (PICiX) Versiones B.02, C.02, C.03, PerformanceBridge Focal Point Versi\u00f3n A.01, Monitores de paciente IntelliVue MX100, MX400-MX850 y MP2-MP90 Versiones N y anteriores, IntelliVue X3 y X2 Versiones N y anteriores. El producto expone un recurso a la esfera de control equivocada, proporcionando a los actores no deseados un acceso inapropiado al recurso. La aplicaci\u00f3n en la estaci\u00f3n de supervisi\u00f3n opera en modo Kiosk, que es vulnerable a filtraciones locales que podr\u00edan permitir a un atacante con acceso f\u00edsico escapar el entorno restringido con privilegios limitados"
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "attackVector": "PHYSICAL",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH",
          "baseScore": 6.8,
          "baseSeverity": "MEDIUM"
        },
        "exploitabilityScore": 0.9,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "accessVector": "LOCAL",
          "accessComplexity": "LOW",
          "authentication": "NONE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL",
          "baseScore": 4.6
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 3.9,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    },
    {
      "source": "ics-cert@hq.dhs.gov",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-668"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:philips:patient_information_center_ix:b.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "C4FA1FEC-5139-48C1-856C-8062436AE6C6"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:philips:patient_information_center_ix:c.02:*:*:*:*:*:*:*",
              "matchCriteriaId": "F3220AB2-AC0D-4AC2-90D8-76C02FC693EB"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:philips:patient_information_center_ix:c.03:*:*:*:*:*:*:*",
              "matchCriteriaId": "AE1FB3E9-E269-434A-B1C2-D54C40F437BE"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://us-cert.cisa.gov/ics/advisories/icsma-20-254-01",
      "source": "ics-cert@hq.dhs.gov",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ]
    },
    {
      "url": "https://www.philips.com/productsecurity",
      "source": "ics-cert@hq.dhs.gov"
    }
  ]
}