Vulnerability · Published Sep 13, 2022 · Assigned by icscert
CVE-2022-38453Contec Health CMS8000
Low 3.0
In plain English
A low-severity security flaw in CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor from Contec Health. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)3.0Low
Exploit odds (30 days)0.2%top 91.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Contec Health | CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor | All |
Weakness: CWE-489 · Vector: CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N
References
- https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01 x_refsource_MISC