CISA, FDA warn of vulnerabilities in Contec patient monitors 

The Cybersecurity and Infrastructure Security Agency and Food and Drug Administration Jan. 30 released notices warning of vulnerabilities found in the Contec CMS8000, a patient monitoring device used to display patient vital signs. The vulnerabilities also apply to Epsimed MN-120 patient monitors, which are Contec CMS8000 monitors relabeled as MN-120, according to the FDA. 

The agencies found that the monitors could be remotely controlled by an unauthorized user or not work as intended. In addition, the software includes a backdoor, meaning the device or network to which the device has been connected may have been or could be compromised. When the monitor is connected to the internet, it collects patient data that includes personally identifiable information and protected health information. 

The vulnerabilities can allow unauthorized actors to bypass cybersecurity controls and then gain access to and potentially manipulate the device. 

“The identified vulnerabilities should be immediately addressed as they are now widely published and are no doubt within the hands of cyber adversaries who would seek to exploit them,” said John Riggi, AHA national advisor for cybersecurity and risk. “We would recommend that information security teams coordinate closely with clinical engineering or biomed teams to identify the inventory of affected monitors and to ensure patch status. 

“Ensuring network segmentation of medical devices and maintaining enterprise-wide patch management programs are best practices. This vulnerability once again demonstrates the cyber risk exposure that hospitals and health systems face through insecure third-party technology, ultimately posing a risk to patient safety.” 

For more information on this or other cyber and risk issues, contact Riggi at jriggi@aha.org. For the latest cyber and risk resources and threat intelligence, visit aha.org/cybersecurity.