Vulnerability · Published Sep 13, 2022 · Assigned by icscert

CVE-2022-36385Contec Health CMS8000

Medium 6.8

In plain English

A medium-severity improper access control in CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor from Contec Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 67.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device.

Affected products (as reported)

Vendor	Product	Versions
Contec Health	CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor	All

Weakness: CWE-284 · Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01 x_refsource_MISC