Skip to content
OpenAdvisories
Critical ICSMA-25-030-01 4 CVEs

Contec Health CMS8000 Patient Monitor (Update A)

Published Jan 30, 2025 · Updated Feb 25, 2025 · Revision 2

Vendor: Contec Health Product: CMS8000 Patient Monitor Product: CMS8000 Patient Monitor Firmware

Summary

Successful exploitation of these vulnerabilities could allow an attacker to remotely send specially formatted UDP requests or connect to an unknown external network that would allow them to write arbitrary data, resulting in remote code execution. The device may also leak patient information and sensor data to the same unknown external network. Simultaneous exploitation of all vulnerable devices on a shared network is possible.

Vulnerabilities 4

  • Critical 9.8
    CVE-2024-12248

    Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor

    Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data. This could result in remote code execution.

    Contec Health CMS8000 Patient Monitor
  • High 7.7
    CVE-2025-1204

    The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP addres…

    Contec Health CMS8000 Patient Monitor
  • High 7.5
    CVE-2025-0626

    Hidden Functionality vulnerability in Contec Health CMS8000 Patient Monitor

    The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is disabled. The func…

    Contec Health CMS8000 Patient Monitor
  • Medium 5.9
    CVE-2025-0683

    Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor

    In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with th…

    Contec Health CMS8000 Patient Monitor

Revision history

  1. #2

    Update A - Added CVE-2025-1204, updated description for CVE-2025-0626. Added mitigations for the specific IP addresses. Added researcher credit to Claroty for CVE-2025-1204.

  2. #1

    Initial Publication

References