{"id":"CVE-2020-10598","url":"https://www.cyber-defence.io/tools/cve/CVE-2020-10598","generatedAt":"2026-10-27T22:33:24.984Z","title":"In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices.","description":"In BD Pyxis MedStation ES System v1.6.1 and Pyxis Anesthesia (PAS) ES System v1.6.1, a restricted desktop environment escape vulnerability exists in the kiosk mode functionality of affected devices. Specially crafted inputs could allow the user to escape the restricted environment, resulting in access to sensitive data.","published":"2020-04-01T21:15:14.000Z","lastModified":"2026-06-17T02:48:04.000Z","status":"Modified","sourceIdentifier":"ics-cert@hq.dhs.gov","cvss":{"version":"3.1","score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"},"cwe":["CWE-693"],"affected":["bd/pyxis medstation es firmware","bd/pyxis anesthesia station es firmware"],"epss":{"score":0.00334,"percentile":0.26503,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"low","text":"Lower severity and a low EPSS score (0.33%). Track it; it rarely justifies an emergency change on its own."},"changes":[],"references":[{"url":"https://www.us-cert.gov/ics/advisories/icsma-20-091-01","tags":["Third Party Advisory","US Government Resource"],"source":"ics-cert@hq.dhs.gov"},{"url":"https://www.us-cert.gov/ics/advisories/icsma-20-091-01","tags":["Third Party Advisory","US Government Resource"],"source":"af854a3a-2127-422b-91ae-364da2661108"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2020-10598","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}