TI-2025-01029 Aliases CVE-2025-1204 GHSA-f9x4-234p-wh9g

The "update" binary in the firmware of the affected product sends attempts to mount to a…

HIGH 69CWE-912Published 2025-02-25 · Updated 2025-02-25

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: Present
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

The "update" binary in the firmware of the affected product sends attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function triggers if the 'C' button is pressed at a specific time during the boot process. If an attacker is able to control or impersonate this IP address, they could upload and overwrite files on the device.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00483 41st percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Contec Health	CMS8000 Patient Monitor	all versions	—	No fix listed	CNA

CMS8000 Patient Monitor VendorContec Health Affected all versions Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2025-1204
2026-10-03 Alias added: GHSA-f9x4-234p-wh9g

References

Advisory 1

https://claroty.com/team82/research/are-contec-cms8000-patient-monitors-infected-with-a-chinese-backdoor-the-reality-is-more-complicated?ref=vault33.org

Other 1

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-030-01

TI-2024-11359 Out-of-bounds Write vulnerability in Contec Health CMS8000 Patient Monitor CVSS 4.0CRITICAL 9.3
TI-2022-17808 Uncontrolled resource consumption in Contec Health CMS8000 CONTEC ICU CCU Vital Signs… CVSS 3.1HIGH 7.5
TI-2025-00526 Hidden Functionality vulnerability in Contec Health CMS8000 Patient Monitor CVSS 4.0HIGH 7.7
TI-2025-00577 Exposure of Private Personal Information to an Unauthorized Actor vulnerability in Contec Health CMS8000 Patient Monitor CVSS 4.0HIGH 8.2
TI-2022-16724 Improper access control in Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient… CVSS 3.1MEDIUM 6.8
TI-2022-17783 Hard-coded credentials in Contec Health CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor CVSS 3.1MEDIUM 6.1

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences