Vulnerability

Philips IntelliVue monitors and PIC iX skip certificate revocation and crash on bad input

MedDevice Cyber Staff · Sep 10 · 4 min read · Via CISA ICSMA-20-254-01

CISA published advisory ICSMA-20-254-01 on September 10, 2020, later revised as Update C, covering eight vulnerabilities across Philips IntelliVue patient monitors (MX100, MX400 to MX850, MP2 to MP90, X2 and X3, versions N and prior), Patient Information Center iX (PIC iX) B.02, C.02 and C.03, and PerformanceBridge Focal Point A.01. ERNW researchers and Germany's Federal Office for Information Security (BSI) are credited.

The highest score is CVE-2020-16212 (CWE-668, CVSS v3 6.8): the PIC iX surveillance station runs in kiosk mode, and someone with physical access can break out of it with limited privileges. CVE-2020-16228 (CWE-299, CVSS 6.0) means PIC iX, Focal Point and several IntelliVue monitors do not check whether a certificate has been revoked, so a compromised certificate keeps working.

Availability takes three hits. CVE-2020-16216 (CVSS 6.5) lets crafted input restart IntelliVue monitors. CVE-2020-16224 (CVSS 6.5) mishandles a length field and restarts the PIC iX application. CVE-2020-16220 (CVSS 3.5) crashes the certificate enrollment service, which leaves monitoring running but blocks new devices from enrolling.

The remainder are lower: improper authentication in PIC iX and Focal Point (CVE-2020-16222, CVSS 5.0), cross-site scripting in a read-only web application that could expose patient data (CVE-2020-16218), and CSV formula injection in exported files (CVE-2020-16214). Every path needs physical access to stations and monitors or access to the medical device network.

Philips released PIC iX C.03, an updated PerformanceBridge Focal Point, and IntelliVue N.00 and N.01, with an upgrade path through service for M.04. Certificate revocation reached PIC iX and Focal Point in 2023, with IntelliVue monitors scheduled for Q3 2024.

Four years from advisory to revocation checking on the bedside monitors shows how slowly PKI hygiene moves once devices are in the field.

Are you a representative of Philips? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Upgrade PIC iX to C.03, update PerformanceBridge Focal Point, and move IntelliVue monitors to N.00 or N.01, using Philips service for M.04 units. Keep the medical device network isolated and control physical access to surveillance stations, since every flaw needs one or the other.

Upgrade PIC iX and Focal Point. Install PIC iX C.03 and the current PerformanceBridge Focal Point release.
Update IntelliVue monitors. Move to N.00 or N.01; contact Philips service for M.04 upgrade paths.
Lock down surveillance stations. Restrict physical access to PIC iX stations so the kiosk breakout cannot be attempted.
Isolate the monitoring network. Keep the medical device network separate so crafted input cannot reach monitors from general hosts.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Hospital network

Contributing

Handles patient data Web interface Physiological waveform processing Wired network

IntelliVue patient monitors

PID-4113

Patient Information Center iX (PIC iX)

PID-311 Web interface Handles patient data

Fix the class in your product

Malformed or excessive input pushes the service over, and on a monitor that means the screen goes dark. As the maker, validate and bound every input at the boundary, handle malformed messages as a defined error path, and watchdog the clinical display so a fault recovers to a safe view.

Validate and bound input. Enforce type, size, and rate limits; null-check before you dereference.
Fail safe. Handle malformed input as a defined error path, never an unchecked dereference.
Watchdog the display. On a monitor, restore the clinical view quickly and safely after a fault.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Infinity Gateway Suite	Dräger	Same FDA device type	No feedback feed from manufacturer
CARESCAPE B450, E-musb	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
Monitor B125, Monitor B105	GE HealthCare	Same FDA device type	No feedback feed from manufacturer
Next Generation NetKonnect	Nihon Kohden	Same FDA device type	No feedback feed from manufacturer
Assert-IQ (DM5000)	Abbott	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Image Suite	Carestream Health	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer
aPROMISE X	Exini Diagnostics	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Same property (MITRE EMB3D)PID-311	No feedback feed from manufacturer
Vscan Air	GE HealthCare	Same property (MITRE EMB3D)PID-4113	No feedback feed from manufacturer

15 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

What is CVE-2020-16228 in Philips IntelliVue and PIC iX?

CVE-2020-16228 (CWE-299, CVSS v3 6.0) is a missing certificate revocation check in Philips PIC iX C.02 and C.03, PerformanceBridge Focal Point A.01 and IntelliVue MX100, MX400 to MX550, MX750, MX850 and X3 monitors, versions N and prior. CISA covered it in ICSMA-20-254-01, first published September 10, 2020.

Which Philips versions fix ICSMA-20-254-01?

Philips released Patient Information Center iX C.03, an updated PerformanceBridge Focal Point and IntelliVue patient monitor versions N.00 and N.01, with M.04 upgrades through Philips service, according to CISA advisory ICSMA-20-254-01 from September 10, 2020.

When did Philips add certificate revocation to IntelliVue monitors?

Philips implemented certificate revocation for PIC iX and PerformanceBridge Focal Point in 2023 and scheduled IntelliVue patient monitors for Q3 2024, per the Update C revision of CISA advisory ICSMA-20-254-01.

← Back to Vulnerabilities