Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor
43Vexday Risk Score
Prioriza la corrección. Ella explotación observada por VulnCheck.
ssvc Actcvss 8.2epss 0.8%
de la publicación al arma
Publicada en NVD30 ene
VulnCheck+355d
probabilidad de explotación
0.8%top 48% de las CVE
explotación observada
síVulnCheck
In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text
patient data to a hard-coded public IP address when a patient is hooked
up to the monitor. This could lead to a leakage of confidential patient
data to any device with that IP address or an attacker in a
machine-in-the-middle scenario.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Productos afectados
Contec Health · CMS8000 Patient MonitorReferencias
https://www.bleepingcomputer.com/news/security/backdoor-found-in-two-healthcare-patient-monitors-linked-to-ip-in-china/https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01https://www.cisa.gov/resources-tools/resources/contec-cms8000-contains-backdoorhttps://www.fda.gov/medical-devices/safety-communications/cybersecurity-vulnerabilities-certain-patient-monitors-contec-and-epsimed-fda-safety-communication