Philips Ultrasound Systems Authentication Bypass Using an Alternate Path or Channel
Priority LOW 20CWE-288Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-288.
Summary
In Philips Ultrasound ClearVue Versions 3.2 and prior, Ultrasound CX Versions 5.0.2 and prior, Ultrasound EPIQ/Affiniti Versions VM5.0 and prior, Ultrasound Sparq Version 3.0.2 and prior and Ultrasound Xperius all versions, an attacker may use an alternate path or channel that does not require authentication of the alternate service login to view or modify information.
Why it matters now
EPSS 0.00299 22nd percentileScored 2026-11-07
Fix Fixed Ultrasound ClearVue (Philips): versions 3.2Ultrasound CX (Philips): versions 5.0.2+2 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Philips | Ultrasound ClearVue | before versions 3.2 | versions 3.2 | Patch available | CNA |
| Philips | Ultrasound CX | before versions 5.0.2 | versions 5.0.2 | Patch available | CNA |
| Philips | Ultrasound EPIQ/Affiniti | before versions VM5.0 | versions VM5.0 | Patch available | CNA |
| Philips | Ultrasound Sparq | before version 3.0.2 | version 3.0.2 | Patch available | CNA |
| Philips | Ultrasound Xperius | all versions | — | No fix listed | CNA |
- Ultrasound ClearVue VendorPhilips Affected before versions 3.2 Fixed in versions 3.2 Patch available CNA
- Ultrasound CX VendorPhilips Affected before versions 5.0.2 Fixed in versions 5.0.2 Patch available CNA
- Ultrasound EPIQ/Affiniti VendorPhilips Affected before versions VM5.0 Fixed in versions VM5.0 Patch available CNA
- Ultrasound Sparq VendorPhilips Affected before version 3.0.2 Fixed in version 3.0.2 Patch available CNA
- Ultrasound Xperius VendorPhilips Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 16
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:philips:clearvue_850_firmware:*:*:*:*:*:*:*:* | up to 3.2 | Vulnerable | Philips |
| cpe:2.3:h:philips:clearvue_850:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
| cpe:2.3:o:philips:clearvue_350_firmware:*:*:*:*:*:*:*:* | up to 3.2 | Vulnerable | Philips |
| cpe:2.3:h:philips:clearvue_350:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
| cpe:2.3:o:philips:cx50_firmware:5.0.2:*:*:*:*:*:*:* | 5.0.2 | Vulnerable | Philips |
| cpe:2.3:h:philips:cx50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
| cpe:2.3:o:philips:affiniti_70_firmware:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Philips |
| cpe:2.3:h:philips:affiniti_70:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
| cpe:2.3:o:philips:affiniti_50_firmware:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Philips |
| cpe:2.3:h:philips:affiniti_50:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
- cpe:2.3:o:philips:clearvue_850_firmware:*:*:*:*:*:*:*:* Versions up to 3.2 Vulnerable ·Philips
- cpe:2.3:h:philips:clearvue_850:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
- cpe:2.3:o:philips:clearvue_350_firmware:*:*:*:*:*:*:*:* Versions up to 3.2 Vulnerable ·Philips
- cpe:2.3:h:philips:clearvue_350:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
- cpe:2.3:o:philips:cx50_firmware:5.0.2:*:*:*:*:*:*:* Versions 5.0.2 Vulnerable ·Philips
- cpe:2.3:h:philips:cx50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
- cpe:2.3:o:philips:affiniti_70_firmware:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Philips
- cpe:2.3:h:philips:affiniti_70:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
- cpe:2.3:o:philips:affiniti_50_firmware:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Philips
- cpe:2.3:h:philips:affiniti_50:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
Show 6 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:philips:epiq_7_firmware:*:*:*:*:*:*:*:* | up to 5.0 | Vulnerable | Philips |
| cpe:2.3:h:philips:epiq_7:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
| cpe:2.3:o:philips:sparq_firmware:*:*:*:*:*:*:*:* | up to 3.0.2 | Vulnerable | Philips |
| cpe:2.3:h:philips:sparq:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
| cpe:2.3:o:philips:xperius_firmware:*:*:*:*:*:*:*:* | all versions | Vulnerable | Philips |
| cpe:2.3:h:philips:xperius:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Philips |
- cpe:2.3:o:philips:epiq_7_firmware:*:*:*:*:*:*:*:* Versions up to 5.0 Vulnerable ·Philips
- cpe:2.3:h:philips:epiq_7:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
- cpe:2.3:o:philips:sparq_firmware:*:*:*:*:*:*:*:* Versions up to 3.0.2 Vulnerable ·Philips
- cpe:2.3:h:philips:sparq:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
- cpe:2.3:o:philips:xperius_firmware:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Philips
- cpe:2.3:h:philips:xperius:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Philips
Remediation
- Fix · CNA Ultrasound ClearVue (Philips) Fixed in versions 3.2
- Fix · CNA Ultrasound CX (Philips) Fixed in versions 5.0.2
- Fix · CNA Ultrasound EPIQ/Affiniti (Philips) Fixed in versions VM5.0
- Fix · CNA Ultrasound Sparq (Philips) Fixed in version 3.0.2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-14477
- 2026-10-03 Alias added: GHSA-p4jj-wjcf-vhhr
References
Sources
- CVE-2020-14477 · CVE Program
- CVE-2020-14477 · NVD
- FIRST EPSS
- GHSA-p4jj-wjcf-vhhr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences