Vulnerability · Published Jan 30, 2025 · Assigned by icscert
CVE-2025-0683Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor
Medium 5.9
In plain English
A medium-severity security flaw in CMS8000 Patient Monitor from Contec Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)5.9Medium
Exploit odds (30 days)0.8%top 44.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a machine-in-the-middle scenario.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contec Health | CMS8000 Patient Monitor | All versions |
Weakness: CWE-359 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01
- https://www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-certain-patient-monitors-contec-and-epsimed-fda-safety-communication
- https://www.cisa.gov/resources-tools/resources/contec-cms8000-contains-backdoor
- https://www.bleepingcomputer.com/news/security/backdoor-found-in-two-healthcare-patient-monitors-linked-to-ip-in-china/