# Integral Security Pillars for Medical Devices:
## 9 Who
### Presentation of the Data and Analysis of the Results
#### 3.3.3 Analysis of Data Extracted from the Common Vulnerabilities Exposed  
The following Table 15 shows a comparison between the vulnerabilities and their relationship with the security regulations. \begin{table}
\begin{tabular}{l l l l} \hline \hline
**CVE** & **Model** & **Type of Attack** & **Normatives** \\ \hline CVE-2025-2230 & Philips Intelligence & Replay attacks, & HITRUST: AC-1, AC-4; \\  & Cardiovascular & authentication bypass & NIST SP 800-53: AC-2; ISO \\  & & & 27001: A.9.1 \\ CVE-2025-2229 & Philips Intelligence & Fixed AES-128 encryption & HITRUST: AC-4, SC-7; \\  & Cardiovascular & key vulnerability & GDPR: Art. 32; NIST SP \\  & & & 800-53: SC-12, SC-13 \\ CVE-2020-16237 & Philips SureSigns VS4 & Exploitable remotely & HITRUST: AC-4, SC-7; ISO \\  & & & 27001: A.13.1 \\ CVE-2020-16239 & Philips SureSigns VS4 & Exploitable remotely & HITRUST: AC-4, SC-7; ISO \\  & & & 27001: A.13.1 \\ CVE-2020-1624 & Philips SureSigns VS4 & Exploitable remotely & HITRUST: AC-4, SC-7; ISO \\  & & & 27001: A.13.1 \\ CVE-2020-16216 & Philips IntelliVue MX700 & Exploitable remotely & HITRUST: AC-2, SC-5; \\  & and MX800 & Low attack complexity & NIST SP 800-53: AC-2 \\  & & & HITRUST: SI-1, AC-6; NIST \\  & & & \\ CVE-2019-13530 & Philips IntelliVue MX700 & code download without & SP 800-53: AC-5, SC-8; ISO \\  & and MX800 & integrity check & 27001: A.14.2.5 \\ CVE-2020-16214 & Philips IntelliVue MX100 & Low attack complexity & HITRUST: AC-2, SC-5; \\  & & & NIST SP 800-53: AC-2 \\  & & & \\ CVE-2018-19001 & Philips HealthSuite Health & Inadequate encryption & HITRUST: SC-13, AC-12; \\  & & & \\ Android App, all versions & strength & NIST SP 800-53: SC-12, \\  & & & \\ \hline \hline \end{tabular}
\end{table} 
Table 15: Comparative table of vulnerabilities and their relation to regulations. Figure 4: Total words per occurrence. Top 20 words from the “Variables” column corresponding to Table 7. \begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline
\begin{tabular}{} \end{tabular} \\ \hline \end{tabular}
\end{table} 
Table 15: _Cont._The following table provides a classification of attack types commonly identified in the field of cybersecurity for medical systems and devices. Each attack type is accompanied by its respective abbreviation to facilitate reference in the subsequent analysis. See Table 16 and Figure 5. \begin{table}
\begin{tabular}{l l} \hline
**Types of Attacks** & **Abbreviation** \\ \hline Exploitable remotely/low skill level to exploit & ER \\ Remote exploit & RX \\ Buffer overflow & BO \\ SQL injection vulnerability & SQL \\ Low attack complexity & LAC \\ Authentication bypass using an alternate path or channel & ABU \\ Embedded malicious code & EM \\ Execute code & EX \\ Exploitation activity & EA \\ Exposure of private personal information to an & EPP \\ unauthorized actor & HF \\ Hidden functionality & IES \\ Information leak & IL \\ OS command injection vulnerabilities & OCI \\ Probability of exploitation activity & PIV \\ Replay attacks and authentication bypass & RAA \\ The “monitor” binary in the firmware of the affected & \\ product attempts to mount to a hard-coded, routable IP & MB \\ address & The software does not perform any authentication for \\ critical system functionality & SDN \\ The vulnerability allows for an unauthorized disclosure of & \\ system information through HTTP headers & VAF \\ Token reuse vulnerability & TRV \\ Use of hard-coded password, download of code without & UHP \\ \hline \end{tabular}
\end{table} 
Table 16: List of identified attacks with their respective abbreviations according to Table 15.