CVE-2020-14477
Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or Channel
- Published
- Updated
- Reserved
- Assigned by
- icscert
Description
In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sparq Version 3.0.2 and prior and Ultrasound Xperius all versions, an attacker may use an alternate path or channel that does not require authentication of the alternate service login to view or modify information.
Timeline
ID reserved
By icscert
- 7 days later
· 7 days later
Published
- 5 years later
· 5 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| icscertCNA (assigner) | 3.1 | Low3.6 | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N |
| NVDNVD · Modified | 3.1 | Medium4.4 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N |
- EPSS (exploitation in 30 days)
- 0.30% · top 77% of all CVEs (7 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.6.
Weakness
Affected products
- affected < versions 3.2
- affected < versions 5.0.2
Philips · Ultrasound EPIQ/Affiniti
- affected < versions VM5.0
- affected < version 3.0.2
- affected all versions
What to do
Solution: Philips released Ultrasound EPIQ/Affiniti Version VM6.0 in April 2020 and recommends users with the Ultrasound EPIQ/Affiniti systems to contact their local Philips service support team, or regional service support for installation information. Philips is currently planning the following new releases: * Ultrasound ClearVue Version 3.3 release in Q4 2020 * Ultrasound CX Version 5.0.3 release in Q4 2020 * Ultrasound Sparq Version 3.0.3 release in Q4 2020 As an interim mitigation to this vulnerability, Philips recommends customers ensure service providers can guarantee installed device integrity during all service and repair operations. Users with questions regarding their specific Ultrasound installation should contact the Philips service support team or regional service support. Users can contact Philips customer service https://www.usa.philips.com/healthcare/solutions/customer-service-solutions , and find more details in the Philips advisory http://www.philips.com/productsecurity (external link). Please see the Philips product security website http://www.philips.com/productsecurity for the latest security information for Philips products.
References (1)
- https://www.us-cert.gov/ics/advisories/icsma-20-177-01 (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-14477)Record last updated .