Potential Backdoor Embedded in Contec Health CMS8000 Patient Monitor Firmware.

CISA has found evidence of Contec CMS8000 and re-labelled Epsimed MN-120 devices beaconing to a public IP address

CISA has found evidence of Contec CMS8000 and re-labelled Epsimed MN-120 devices beaconing to a public IP address

The following platforms are known to be affected:

Contec CMS8000 Patient Monitor

Epsimed MN-120 Patient Monitor

Re-labelled Contec CMS8000 devices

Comtec CMS8000 devices can also be re-labelled and sold by resellers. U.S. authorities have identified that Epsimed MN-120 patient monitors are re-labelled Comtec CMS8000 devices and are also affected.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has published a medical product advisory for the Contec Health CMS8000 Patient Monitor to address one critical and three high severity vulnerabilities . The Contec CMS8000 is a patient monitor used to display real-time information such as the vital signs of a patient, including temperature, heartbeat, and blood pressure. Additionally, the CMS8000 includes remote monitoring features, which use an internet connection to allow a healthcare provider to evaluate patient vital signs from another location.

CISA and the U.S. Food and Drug Administration (FDA) have advised that all versions of the CMS8000 firmware potentially contain a backdoor and are vulnerable to remote code execution (RCE).

Embedded backdoor function in Contec CMS8000 firmware

CISA is advising that all versions of the CMS8000 firmware contain a backdoor to a hardcoded public IP address. Confidential patient data may be exfiltrated by an attacker using this backdoor.

Affected organisations are strongly encouraged to review CISA advisory ICSMA-25-030-01 and follow the mitigations recommended below.

Any actions taken by affected organisations should be conducted in accordance with local risk tolerances and subjected to a local risk assessment.

The affected product is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data. This could result in remote code execution.

The affected product sends out remote access requests to a hard-coded IP address, bypassing existing device network settings to do so. This could serve as a backdoor and lead to a malicious actor being able to upload and overwrite files on the device.

In its default configuration, the affected product transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a machine-in-the-middle scenario.

The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.

Last edited: 26 February 2025 11:33 am