LIVE FEED

CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response CISA: every Flow Neuroscience FL-100 tDCS headset shares one hardcoded BLE credential, CVE-2026-18164 rated 8.1 Coalition for Health AI convenes 100 member cyber work group, AI attack and defense playbooks due by year end CRA Article 14 reporting obligations take effect September 11 EU MDR revision proposal adds a 30 day exploited-vulnerability reporting clock via Eudamed Mira hormone monitor cloud API handed session tokens to any password, CVE-2026-68067 rated 9.8 Pulsetto vagus nerve stimulator ships hidden BLE commands: no patch, no vendor response

Vulnerability

A patient monitor with a hidden backdoor that phones home

MedDevice Cyber Staff · Jan 30 · 4 min read · Via CISA

Read the CISA and FDA fact sheets on this one before you read the advisory. Both agencies took the unusual step of publishing companion guidance on a backdoor, which is the government telling hospitals to treat these monitors as compromised by design rather than flawed.

ICSMA-25-030-01 describes hidden functionality in the Contec CMS8000 patient monitor firmware. The device beacons to a hard-coded external IP and can pull and execute files from it. CVE-2024-12248 carries a 9.8. Claroty Team82 contributed one of the CVEs.

And the same firmware turns up in relabeled monitors sold under other brands. Buy the OEM board, ship it under your name, inherit the backdoor along with it. If you white-label hardware, you own the security of every component you resell, including firmware you never saw and cannot read.

Remediation Desk

The Contec CMS8000 monitor firmware beacons to a hard-coded IP and can pull and run files, with CISA and FDA issuing companion backdoor fact sheets, and the same firmware sits in relabeled monitors. There is no simple patch, so isolate affected monitors from the network and inventory relabeled units carrying the same firmware.

Isolate affected monitors. Cut network access for CMS8000 units so the firmware cannot reach its hard-coded destination.
Hunt for relabeled units. The same firmware ships in monitors sold under other brands, so inventory by firmware, not just by label.
Demand provenance from suppliers. Require firmware bills of materials and provenance so hidden functionality is caught before procurement, not after.

Sources

CISA ↗

Questions & Answers

What is the backdoor in the Contec CMS8000 patient monitor?

ICSMA-25-030-01 describes hidden functionality in the firmware: the monitor beacons to a hard-coded external IP address and can download and execute files from it. CVE-2024-12248 carries a 9.8.

Why did CISA and FDA publish fact sheets on the CMS8000?

Both agencies issued companion guidance telling hospitals to treat the monitors as compromised by design rather than merely flawed, an unusual step reserved for a backdoor.

Are relabeled versions of the CMS8000 affected?

Yes. The same firmware ships in monitors sold under other brand names, so white-labeled units inherit the backdoor along with the OEM board.

← Back to Vulnerabilities