A patient monitor with a hidden backdoor that phones home

MedDevice Cyber Staff · Jan 30 · 4 min read · Via CISA

Read the CISA and FDA fact sheets on this one before you read the advisory. Both agencies took the unusual step of publishing companion guidance on a backdoor, which is the government telling hospitals to treat these monitors as compromised by design rather than flawed.

Companion fact sheets from both agencies are not a routine accompaniment to an advisory, and the escalation is the message. Ordinary flaws draw a lone notice and a fix; coordinated guidance signals that officials judged the behavior deliberate and the usual patch-and-move-on model inadequate. Calling a device compromised by design rather than defective shifts a hospital's task from awaiting a corrected build toward containing equipment already on the floor.

ICSMA-25-030-01 describes hidden functionality in the Contec CMS8000 patient monitor firmware. The device beacons to a hard-coded external IP and can pull and execute files from it. CVE-2024-12248 carries a 9.8. Claroty Team82 contributed one of the CVEs.

Hidden functionality is not the accidental hole an attacker must find and pry open; it is capability built into the firmware itself. The monitor reaches out to a fixed external address and stands ready to run whatever it is handed. Such a device is not merely leaking data; it is an untrusted computer wearing the badge of a patient monitor, on the same network as pharmacy systems and records.

What unsettles investigators is provenance. Hospitals, and even the brand on the bezel, generally cannot read the firmware inside equipment like this; it arrives as a sealed image from a contract manufacturer and is treated as a finished part. That opacity is ordinary in how commodity medical hardware is sourced, which is why a questionable image can spread across many catalogs before anyone examines it.

And the same firmware turns up in relabeled monitors sold under other brands. Buy the OEM board, ship it under your name, inherit the backdoor along with it. If you white-label hardware, you own the security of every component you resell, including firmware you never saw and cannot read.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The Contec CMS8000 monitor firmware beacons to a hard-coded IP and can pull and run files, with CISA and FDA issuing companion backdoor fact sheets, and the same firmware sits in relabeled monitors. There is no simple patch, so isolate affected monitors from the network and inventory relabeled units carrying the same firmware.

Isolate affected monitors. Cut network access for CMS8000 units so the firmware cannot reach its hard-coded destination.
Hunt for relabeled units. The same firmware ships in monitors sold under other brands, so inventory by firmware, not just by label.
Demand provenance from suppliers. Require firmware bills of materials and provenance so hidden functionality is caught before procurement, not after.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Contributing

net_cloud sys_ots_software net_wireless net_wired sys_firmware_update data_phi use_hospital_net app_database

EMB3D

PID-15 PID-22 PID-41

Fix the class in your product

The firmware does something undocumented: beacons to a hard-coded address, answers a hidden command. As the maker, strip every debug and undocumented path from the release image, remove hard-coded destinations, and require a firmware bill of materials and provenance for every sourced component.

Strip debug paths. Compile diagnostic and undocumented handlers out of the release build and assert their absence.
Remove hard-coded destinations. Every network destination is configured and validated, never baked in.
Demand provenance. Require and verify a firmware bill of materials for sourced blobs.

Mapped EMB3D mitigations

Questions & Answers

What is the backdoor in the Contec CMS8000 patient monitor?

ICSMA-25-030-01 describes hidden functionality in the firmware: the monitor beacons to a hard-coded external IP address and can download and execute files from it. CVE-2024-12248 carries a 9.8.

Why did CISA and FDA publish fact sheets on the CMS8000?

Both agencies issued companion guidance telling hospitals to treat the monitors as compromised by design rather than merely flawed, an unusual step reserved for a backdoor.

Are relabeled versions of the CMS8000 affected?

Yes. The same firmware ships in monitors sold under other brand names, so white-labeled units inherit the backdoor along with the OEM board.

← Back to Vulnerabilities