CVE-2025-0626

Contec Health CMS8000 Patient Monitor sends out remote access requests to a hard-coded IP address, bypassing existing device network settings to do so. This could serve as a backdoor and lead to a malicious actor being able to upload and overwrite files on the device.

Weakness

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence that is obvious to the product’s users or administrators.

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/133.html
• https://cwe.mitre.org/data/definitions/190.html

References

• https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01
• https://www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-certain-patient-monitors-contec-and-epsimed-fda-safety-communication
• https://www.bleepingcomputer.com/news/security/backdoor-found-in-two-healthcare-patient-monitors-linked-to-ip-in-china/
• https://www.cisa.gov/resources-tools/resources/contec-cms8000-contains-backdoor
• https://www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-certain-patient-monitors-contec-and-epsimed-fda-safety-communication