CVE-2025-0683: Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor
In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a machine-in-the-middle scenario.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-0683?
CVE-2025-0683 is considered a high severity vulnerability due to the potential unauthorized access to confidential patient data.
How do I fix CVE-2025-0683?
To mitigate CVE-2025-0683, it is recommended to configure the Contec Health CMS8000 Patient Monitor to avoid transmitting data to hard-coded public IP addresses.
What data is exposed by CVE-2025-0683?
CVE-2025-0683 exposes plain-text patient data, which can include sensitive health information.
Which devices are affected by CVE-2025-0683?
The Contec Health CMS8000 Patient Monitor is affected by CVE-2025-0683 in its default configuration.
Can CVE-2025-0683 be exploited remotely?
Yes, CVE-2025-0683 can be exploited remotely by anyone capable of accessing the hard-coded public IP address.