Backdoor found in two healthcare patient monitors, linked to IP in China

BleepingComputer ^ | 1/30/2025 | Lawrence Abrams

[Pete from Shawnee Mission]

The US Cybersecurity and Infrastructure Security Agency (CISA) is warning that Contec CMS8000 devices, a widely used healthcare patient monitoring device, include a backdoor that quietly sends patient data to a remote IP address and downloads and executes files on the device.

Contec is a China-based company that specializes in healthcare technology, offering a range of medical devices including patient monitoring systems, diagnostic equipment, and laboratory instruments.

CISA learned of the malicious behavior from an external researcher who disclosed the vulnerability to the agency. When CISA tested three Contec CMS8000 firmware packages, the researchers discovered anomalous network traffic to a hard-coded external IP address, which is not associated with the company but rather a university.

This led to the discovery of a backdoor in the company's firmware that would quietly download and execute files on the device, allowing for remote execution and the complete takeover of the patient monitors. It was also discovered that the device would quietly send patient data to the same hard-coded address when devices were started. (additional info at link.)

[Pete from Shawnee Mission]

And our steel and cars and telephones.

I agree, and that will probably happen soon!

[Pete from Shawnee Mission]

I have one of these called "The Harmonizer".

I feel pretty safe with mine. No way to input patient info and not connected to the internet.

[Pete from Shawnee Mission]

Probably so.

[Sirius Lee]

if I buy oriental food like green tea or soy sauce I make certain its from Japan and avoid anything originating in China! :)

What? You don't like lead powder?

[Pete from Shawnee Mission]

Or melanine!