PT-2025-3988 · Contec+1 · Contec Health Cms8000 Patient Monitor+1
Published
2025-01-21
·
Updated
2025-03-01
·
CVE-2025-0626
CVSS v4.0
7.7
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Contec Health CMS8000 Patient Monitor (affected versions not specified)
Epsimed MN-120 patient monitor (affected versions not specified)
Description
The affected product sends out remote access requests to a hard-coded IP address, bypassing existing device network settings to do so. This could serve as a backdoor and lead to a malicious actor being able to upload and overwrite files on the device. The issue is related to the device's network configuration bypass mechanism. It has been reported that this issue is being actively exploited.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider disconnecting the device from the network to minimize the risk of exploitation. Restrict access to the device and its components to prevent potential malicious activities. Avoid using the device until a patch or fix is available.
Hidden Functionality
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Contec Health Cms8000 Patient Monitor
Epsimed Mn-120 Patient Monitor