CVE-2020-14477
Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or Channel
02 Description
Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or Channel
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 0.29% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 22.3% of scored records. A rank, not a probability.
- NVD base score
- 4.4 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- No Red Hat rating. Red Hat rates the CVEs that affect its products.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2020-06-26 16:15Z6 YR AGO
- Last updated
- 2025-06-04 21:56Z1 YR AGO
- Reserved
- 2020-06-19
- Assigning CNA
- icscert
- Record state
- PUBLISHED
- Severity
- Low (CVSS 3.6)
- CNA CVSS vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weaknesses
- Data version
- 5.1
- Document digest
- a7d1152fc9f8fdaf124ada4e4c28102133e5ba32182ff601565582c3f0755e27
05 Affected products
06 References
- www.us-cert.govhttps://www.us-cert.gov/ics/advisories/icsma-20-177-01
07 Remediation
Philips released Ultrasound EPIQ/Affiniti Version VM6.0 in April 2020 and recommends users with the Ultrasound EPIQ/Affiniti systems to contact their local Philips service support team, or regional service support for installation information. Philips is currently planning the following new releases: * Ultrasound ClearVue Version 3.3 release in Q4 2020 * Ultrasound CX Version 5.0.3 release in Q4 2020 * Ultrasound Sparq Version 3.0.3 release in Q4 2020 As an interim mitigation to this vulnerability, Philips recommends customers ensure service providers can guarantee installed device integrity during all service and repair operations. Users with questions regarding their specific Ultrasound installation should contact the Philips service support team or regional service support. Users can contact Philips customer service https://www.usa.philips.com/healthcare/solutions/customer-service-solutions , and find more details in the Philips advisory http://www.philips.com/productsecurity (external link). Please see the Philips product security website http://www.philips.com/productsecurity for the latest security information for Philips products.