CVE-2020-16228
CVE-2020-16228 is a medium-severity vulnerability in Philips Patient Information Center Ix with a CVSS 3.x base score of 6.4. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-299.
Key facts
- Severity: Medium (CVSS 3.x base score 6.4)
- CVSS v2: 5.2
- EPSS exploit prediction: 0% (29th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-299
- Affected product: Philips Patient Information Center Ix
- Published:
- Last modified:
Description
In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a compromised certificate.
Frequently asked questions
- What is CVE-2020-16228?
- In Patient Information Center iX (PICiX) Versions C.02 and C.03, PerformanceBridge Focal Point Version A.01, IntelliVue patient monitors MX100, MX400-MX550, MX750, MX850, and IntelliVue X3 Versions N and prior, the software does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a compromised certificate.
- How severe is CVE-2020-16228?
- CVE-2020-16228 has a CVSS 3.x base score of 6.4, rated medium severity. It is exploitable over an adjacent network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
- Is CVE-2020-16228 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (29th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-16228?
- CVE-2020-16228 primarily affects Philips Patient Information Center Ix. In total, 15 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-16228?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2020-16228 published?
- CVE-2020-16228 was published on 2020-09-11 and last updated on 2026-06-17.
References
Affected products (15)
- cpe:2.3:a:philips:patient_information_center_ix:b.02:*:*:*:*:*:*:*
- cpe:2.3:a:philips:patient_information_center_ix:c.02:*:*:*:*:*:*:*
- cpe:2.3:a:philips:patient_information_center_ix:c.03:*:*:*:*:*:*:*
- cpe:2.3:a:philips:performancebridge_focal_point:a.01:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mp2-mp90_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx100_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx400_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx850_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_x2_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_x3_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx800_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx750_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx700_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx600_firmware:-:*:*:*:*:*:*:*
- cpe:2.3:o:philips:intellivue_mx550_firmware:-:*:*:*:*:*:*:*
More vulnerabilities in Philips Patient Information Center Ix
- CVE-2020-16222 — High (CVSS 8.8): In Patient Information Center iX (PICiX) Version B.02, C.02, C.03, and PerformanceBridge Focal Point Version A.01,…
- CVE-2020-16212 — Medium (CVSS 6.8): In Patient Information Center iX (PICiX) Versions B.02, C.02, C.03, the product exposes a resource to the wrong control…
- CVE-2021-43548 — Medium (CVSS 6.5): Patient Information Center iX (PIC iX) Versions C.02 and C.03 receives input or data, but does not validate or…
- CVE-2020-16224 — Medium (CVSS 6.5): In Patient Information Center iX (PICiX) Versions C.02, C.03, the software parses a formatted message or structure but…
- CVE-2020-16216 — Medium (CVSS 6.5): In IntelliVue patient monitors MX100, MX400-550, MX600, MX700, MX750, MX800, MX850, MP2-MP90, and IntelliVue X2 and X3…
- CVE-2021-43552 — Medium (CVSS 6.1): The use of a hard-coded cryptographic key significantly increases the possibility encrypted data may be recovered from…
All CVEs affecting Philips Patient Information Center Ix →
Other CWE-299 vulnerabilities
- CVE-2025-11955 — High (CVSS 8.2): Incorrect validation of OCSP certificates vulnerability in TheGreenBow VPN, versions 7.5 and 7.6. During the IKEv2…
- CVE-2025-3085 — High (CVSS 8.1): A MongoDB server under specific conditions running on Linux with TLS and CRL revocation status checking enabled, fails…
- CVE-2026-4428 — High (CVSS 7.4): A logic error in CRL distribution point validation in AWS-LC before 1.71.0 causes partitioned CRLs to be incorrectly…
- CVE-2026-6899 — Medium (CVSS 5.6): Check for certificate revocation only considers the first matching CRL and ignores other valid CRLs of the same CA in…
- CVE-2025-36057 — Medium (CVSS 5.2): IBM Cognos Analytics Mobile (iOS) 1.1.0 through 1.1.22 is vulnerable to authentication bypass by using the Local…
- CVE-2024-56138 — Medium (CVSS 4.0): notion-go is a collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project…