Vulnerability

Contec CMS8000 patient monitors crash on a UDP broadcast and accept unauthenticated USB firmware

MedDevice Cyber Staff · Sep 1 · 3 min read · Via CISA ICSMA-22-244-01

CISA published advisory ICSMA-22-244-01 on September 1, 2022, covering five vulnerabilities in the Contec Health CMS8000 ICU/CCU vital signs patient monitor. Affected firmware is CMS7.820.075.08/0.740.75 and earlier, CMS7.820.120.01/0.930.95 and earlier, and smart3250-2.6.27-wlan2.1.7.cramfs and earlier. Level Nine reported them.

The highest score goes to CVE-2022-38100 (CWE-770, CVSS v3.1 7.5). A specially formatted UDP request from anyone with network access crashes the monitor and forces a physical reboot. Sent as a UDP broadcast, the same request can take down every CMS8000 on the network at once.

CVE-2022-36385 (CWE-1263, 6.8) needs only momentary physical access: plug in a USB drive and perform a malicious firmware update that permanently changes device functionality. No authentication or controls stand in the way, and CISA describes it as a drive-by attack that works on any CMS8000.

CVE-2022-38069 (CWE-798, 4.3) is a set of globally default credentials shared by all CMS8000 devices, which give privileged access, patient data extraction and parameter changes to anyone with momentary physical access. CVE-2022-3027 (CWE-419, 5.7) lets a Wi-Fi access point with a malicious SSID name write arbitrary files or display incorrect information when the monitor tries to connect. CVE-2022-38453 (CWE-489, 3.0) covers binaries compiled not stripped and with debug info, which makes reverse engineering easier.

No vendor fix is listed. Per FDA recommendation, CISA recommends that users remove any Contec CMS8000 devices from their networks.

A broadcast packet that crashes every monitor on a segment turns one compromised laptop into a unit-wide monitoring outage.

Are you a representative of Contec Health or Contec? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

There is no patch listed for the CMS8000. Per FDA recommendation, CISA recommends removing Contec CMS8000 monitors from networks. Any unit that stays in service should be physically supervised, since USB firmware tampering and default credentials need only momentary access.

Take CMS8000 monitors off the network. Follow the FDA recommendation that CISA relays and disconnect every CMS8000 from hospital networks.
Guard the USB port. Keep units where they are observed, because a USB drive can load malicious firmware with no authentication.
Plan replacement. With no fix listed and globally shared credentials, budget to replace the monitors.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

USB port Wireless connectivity Handles patient data Field-updatable firmware

CMS8000 ICU CCU Vital Signs Patient Monitor

PID-41 PID-14 PID-271 PID-3321 USB port Field-updatable firmware Wireless connectivity Handles patient data

Fix the class in your product

Malformed or excessive input pushes the service over, and on a monitor that means the screen goes dark. As the maker, validate and bound every input at the boundary, handle malformed messages as a defined error path, and watchdog the clinical display so a fault recovers to a safe view.

Validate and bound input. Enforce type, size, and rate limits; null-check before you dereference.
Fail safe. Handle malformed input as a defined error path, never an unchecked dereference.
Watchdog the display. On a monitor, restore the clinical view quickly and safely after a fault.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2022-38100 in the Contec CMS8000 patient monitor?

CVE-2022-38100 (CWE-770, CVSS v3.1 7.5) lets a threat actor with network access send a specially formatted UDP request that crashes the Contec Health CMS8000 patient monitor and requires a physical reboot; a UDP broadcast can hit every CMS8000 on the network. CISA disclosed it in ICSMA-22-244-01 on September 1, 2022.

Is there a patch for the Contec CMS8000 vulnerabilities?

CISA advisory ICSMA-22-244-01 lists no vendor fix for CVE-2022-36385, CVE-2022-38100, CVE-2022-38069, CVE-2022-38453 or CVE-2022-3027 in the Contec Health CMS8000. Per FDA recommendation, CISA recommends removing CMS8000 devices from networks.

Who discovered the Contec CMS8000 patient monitor vulnerabilities?

Level Nine is credited in CISA advisory ICSMA-22-244-01, published September 1, 2022, for reporting five vulnerabilities in the Contec Health CMS8000 ICU/CCU vital signs patient monitor.

← Back to Vulnerabilities

Key Facts

Target Product: CMS8000 ICU CCU Vital Signs Patient Monitor CMS7.820.075.08/0.740.75 and earlier; CMS7.820.120.01/0.930.95 and earlier; smart3250-2.6.27-wlan2.1.7.cramfs and earlier (Contec Health)
Device Type: Vital signs patient monitor
Materials: CMS8000 firmware ≤ CMS7.820.075.08/0.740.75; CMS8000 firmware ≤ CMS7.820.120.01/0.930.95; smart3250-2.6.27-wlan2.1.7.cramfs ≤ 2.6.27-wlan2.1.7
Components: Firmware, Wireless Module, Display
Interfaces: UDP, USB, WiFi
Dataflows: USB Drive to Patient Monitor (firmware update, unauthenticated); Network client to Patient Monitor (UDP request, including broadcast); Wi-Fi Access Point to Patient Monitor (SSID, file writes)
Assets: CMS8000 device firmware (Firmware); Globally default credentials shared by all CMS8000 devices (Credentials); Patient data extractable via default credentials (Patient Data); Device parameters (Software Configuration); Unstripped binaries with debug info (Software Code)
Advisory: ICSMA-22-244-01
CVEs: CVE-2022-38100, CVE-2022-36385
CVSS: 7.5 (v3.1)
Severity: High
Disclosed: Sep 1, 2022
Source: CISA ICSMA-22-244-01

Sources

Manufacturers: on the record

Named in this story? File a statement, correction or update from a corporate email address. It runs under your name, as written, with a link to your advisory.

Submit an official response →

Company pages: Contec Health · Contec