Contec Patient Monitors Not Malicious, but Still Pose Big Risk to Healthcare – Source: www.securityweek.com

The recently flagged backdoor functionality in Contec CMS8000 patient monitors is actually the result of an insecure design that creates risks for patient data, XIoT security firm Claroty says.

Used by healthcare organizations in the US and the European Union to monitor patients’ heart rate, blood pressure, and more, the monitors are manufactured by Chinese company Contec Medical Systems, and are also re-labeled and sold by resellers.

Last week, the US cybersecurity agency CISA and the FDA warned that the firmware running on these devices contains hidden functionality acting as a reverse backdoor, connecting to a hardcoded IP address to siphon data and to receive commands.

According to the two agencies, this functionality could allow attackers to upload and execute unverified files on these devices, altering their functionality and posing a risk to patients’ health.

According to CISA, an analysis of multiple firmware versions for these devices uncovered three security defects, tracked as CVE-2025-0626, CVE-2025-0683, and CVE-2024-12248, which could essentially allow remote attackers to modify files, pilfer data, and achieve remote code execution.

According to Claroty, however, the so-called “hidden functionality” that CISA and the FDA consider a backdoor is not hidden at all and should be considered an insecure design issue.

The hardcoded IP address the Contec CMS8000 patient monitors connect to is specifically mentioned in the products’ operator manual as the Central Management System (CMS) IP address that all organizations should configure their devices with.

“Absent additional threat intelligence, this nuance is important because it demonstrates a lack of malicious intent, and therefore changes the prioritization of remediation activities. Said differently, this is not likely to be a campaign to harvest patient data and more likely to be an inadvertent exposure that could be leveraged to collect information or perform insecure firmware updates,” Claroty says.

After dissecting a CMS8000 monitor, the cybersecurity firm discovered that the hard-coded IP address is used within the device’s update process to mount an NFS share via the network and perform the upgrade routine.

The use of NFS for updates is also insecure, as it opens the door to man-in-the-middle (MitM) attacks and potential code execution, but triggering the update logic requires booting the device and pressing a button on it, meaning that an attacker would need to be physically located near the device to exploit it.

“Although the full update process is very dangerous and risky, to us it does not appear to have malicious intent behind it, especially when considering the manual boldly refers to this IP address, and white-label vendors ask users to configure their internal CMS with this IP address,” Claroty says.

The cybersecurity firm also discovered that the IP address is not reserved for local networks (LAN), but a routable public address/subnet accessible from the web, and that no NFS server is currently hosted at that address.

The patient monitor connects to a hardcoded IP address that is part of the same routable subnet to send data, and Claroty observed it using two communication protocols to send data to the CMS or to other hospital systems.

“In order to block the patient monitor from reaching the public IP addresses it has hardcoded in its firmware, leaking PII, and potentially receiving malicious binaries, we recommend blocking the entire 202.114.4.0/24 subnet in outgoing network traffic on your firewall,” the cybersecurity firm notes.

Claroty devised a proof-of-concept (PoC) attack that abuses the Contec CMS8000’s insecure design to download malicious files to the monitor and execute arbitrary code, obtaining remote shell access to the device and deploying a backdoor, which shows that the monitors are indeed vulnerable to remote attacks.

Organizations using Contec CMS8000 patient monitors are advised to tighten control over the device’s network connection, to block the 202.114.4.0/24 subnet, and avoid using its default IP address for CMS.

“These patient monitors are still running vulnerable code that will always be attempting to connect to an externally routable IP address, so it is recommended to replace them with a more secure device unless the vendor modifies firmware to prevent this action in the future,” Claroty notes.

Related: CISA, FDA Warn of Dangerous Backdoor in Contec Patient Monitors

Related: Aquabot Botnet Targeting Vulnerable Mitel Phones

Related: Rockwell Patches Critical, High-Severity Vulnerabilities in Several Products

Related: DORA’s Deadline Looms: Navigating the EU’s Mandate for Threat Led Penetration Testing