Vulnerability · Published Sep 13, 2022 · Assigned by icscert

CVE-2022-38100Contec Health CMS8000

High 7.5

In plain English

A high-severity uncontrolled resource consumption in CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor from Contec Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)1.0%top 37.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specially formatted UDP request that will cause the entire device to crash and require a physical reboot. A UDP broadcast request could be sent that causes a mass denial-of-service attack on all CME8000 devices connected to the same network.

Affected products (as reported)

Vendor	Product	Versions
Contec Health	CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor	All

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01 x_refsource_MISC