CVE-2025-0683 Details

A vulnerability exists in the Contec Health CMS8000 Patient Monitor, all versions, allowing for the unauthorized transmission of plain-text patient data to a hard-coded public IP address in China. This data exfiltration occurs when the monitor is in use, potentially leading to privacy violations and unauthorized access to sensitive health information. The issue has been linked to a backdoor in the device's firmware, which could allow for remote code execution and manipulation of the device.

The FDA has advised against using the Contec CMS8000 Patient Monitor or the Epsimed MN-120 Patient Monitor, which is a re-labeled version of the CMS8000, due to these vulnerabilities. Health care providers should check for signs of tampering or unusual device behavior. If the monitor is connected to the internet, it should be unplugged and not used until an alternative is found. For those who cannot remove the devices from their networks, CISA recommends blocking the IP address 202.114.4.119 and reviewing network firewall rules to prevent access to potentially affected devices.