Contec Health CMS8000 Patient Monitor (Update A)

Risk Summary

Successful exploitation of these vulnerabilities could allow an attacker to remotely send specially formatted UDP requests or connect to an unknown external network that would allow them to write arbitrary data, resulting in remote code execution. The device may also leak patient information and sensor data to the same unknown external network. Simultaneous exploitation of all vulnerable devices on a shared network is possible.

CVEs (4)

Remediations

• Per FDA recommendation, CISA recommends users remove any Contec CMS8000 devices from their networks.
• If asset owners cannot remove the devices from their networks, users should block 202.114.4.0/24 from their networks, or block 202.114.4.119 and 202.114.4.120.
• Please note that this device may be re-labeled and sold by resellers. For a list of known re-labeled devices, please refer to FDA's safety communication.

Affected Vendors

Affected Products (4)

Affected Sectors

Healthcare and Public Health