LIVE FEED
A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident. A proposed class action accuses University Hospitals of negligence after an October 22 cyberattack that took its MyChart portal offline; the Cleveland patient's suit, filed October 28, claims more than a million records were exposed, a number University Hospitals has not confirmed. University of New Mexico Health Sciences Center disclosed a cyberattack October 26 that diverted ambulances for about two hours; the BYOD extortion group claims it compromised 36,000 systems, a figure UNM has not confirmed. Philips updated its Node2Shell advisory October 27 for CVE-2026-111497, the Node.js Brotli decoder flaw it first flagged October 26 against PIC iX 4.x; the advisory still names no impacted products or fixed version. Philips updated its PHP2Shell advisory October 27 for CVE-2026-109618 and CVE-2026-109619, adding five more affected products including IntelliSpace Portal V12 and Philips Axon to the seven already listed. NorthShore Health Centers disclosed a data breach to patients October 27, one of several Midwest provider notifications issued that week. Denver Health Medical Plan notified more than 238,000 members October 26 about a vendor-related data incident.
Saturday, October 31, 2026 Issue #499  ·  Est. 2025
Independent brief for device makers
Manufacturers // Contec

Contec

Contec in MedDevice Cyber coverage: 2 stories, 1 product named, 1 CVE, and the company's own disclosures.

Follow ContecClaim this page
Stories
2
Products named
1
Product CVEs
1
Responses on record
0
Latest story
Jan 30, 2025

Coverage

2 stories
01
Vulnerability

A patient monitor with a hidden backdoor that phones home

ICSMA-25-030-01: the Contec CMS8000 monitor firmware beacons to a hard-coded IP and can pull and run files. CISA and FDA issued companion backdoor fact sheets, and the same firmware sits in relabeled monitors.

CISAJan 304 min read
02
Vulnerability

Contec CMS8000 patient monitors crash on a UDP broadcast and accept unauthenticated USB firmware

CISA advisory ICSMA-22-244-01 covers five vulnerabilities in the Contec Health CMS8000 patient monitor, including CVE-2022-38100 (CVSS v3.1 7.5), a UDP request that crashes every monitor on a network, and CVE-2022-36385, unauthenticated USB firmware updates. Per FDA recommendation, CISA advises removing the monitors from networks.

CISASep 13 min read

Products in our coverage

  • CMS8000 Patient Monitor smart3250-2.6.27-wlan2.1.7.cramfs; CMS7.820.075.08/0.74(0.75); CMS7.820.120.01/0.93(0.95); vers:all/* patient monitoring system

Products and threat intel

3

Contec products with the device attributes their own public documentation states, and the advisories in our coverage that share those attributes.

ProductDevice typeAttributesMatched advisories
CONTEC08A Electronic SphygmomanometerSystem, Measurement, Blood-Pressure, Non-Invasive110
Pocket Fetal DopplerMonitor, Ultrasonic, Fetal30
Pocket Fetal Doppler (CONTEC 10D)Monitor, Ultrasonic, Fetal30

CVEs in coverage of Contec products

CVE-2024-12248
← All manufacturers