Vulnerability · Published Jan 30, 2025 · Assigned by icscert
CVE-2024-12248Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor
Critical 9.8
In plain English
A critical-severity out-of-bounds write in CMS8000 Patient Monitor from Contec Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)1.3%top 29.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data. This could result in remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contec Health | CMS8000 Patient Monitor | Firmware version smart3250-2.6.27-wlan2.1.7.cramfsFirmware version CMS7.820.075.08/0.74(0.75)Firmware version CMS7.820.120.01/0.93(0.95) |
Weakness: CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H