On 30 January, The Cybersecurity Infrastructure & Security Agency (CISA) released an alert, complemented by a notification from the U.S. Food and Drug Administration (FDA) suggesting that the Contec CMS8000 patient monitor and OEM white-label variants contain a backdoor communicating to a Chinese IP address.

Team82 investigated the firmware and reached the conclusion that it is most likely not a hidden backdoor, but instead an insecure/vulnerable design that introduces great risk to the patient monitor users and hospital networks.

Our conclusion is mainly based on the fact that the vendor—and resellers who re-label and sell the monitor—list the IP address in their manuals and instruct users to configure the Central Management System (CMS) with this IP address within their internal networks.

In addition, the upgrade flow requires a physical button press during the patient monitor boot process.

The hardcoded IPs found in the device are 202.114.4.119 (CMS server) over TCP ports 515-520, 202.114.4.120 (HL7 server) over TCP port 511.

Team82 researched and presented at Claroty’s 2022 Nexus Conference a working PoC exploiting the insecure design flaw in the Contec CMS8000 and attacking the patient monitor, below.

Background

On Jan. 30, CISA released an alert, complemented by a notification from the FDA suggesting that the Contec CMS8000 patient monitor and its white-label OEM variants (see Likely White Label Variant section below) contains a backdoor. Because this is a patient monitor manufactured in China, the notification alerts healthcare providers that the device “can create conditions which may allow remote code execution and device modification with the ability to alter its configuration. This introduces risk to patient safety as a malfunctioning monitor could lead to improper responses to vital signs displayed by the device.” The notification states explicitly that this backdoor is “hidden functionality” (CWE-912), pointing to a hardcoded-IP address in China for the outbound communication of patient data and firmware updates.

Summary of Team82’s Findings

Through Team82’s analysis, we have come to the conclusion that this alert is not a hidden backdoor as suggested by CISA and the FDA, but instead an insecure design issue, creating potential security risks to patient data. The CONTEC Operator Manual specifically mentions this “hard-coded” IP address as the Central Management System (CMS) IP address that organizations should use, so it is not hidden functionally as stated by CISA.

Absent additional threat intelligence, this nuance is important because it demonstrates a lack of malicious intent, and therefore changes the prioritization of remediation activities. Said differently, this is not likely to be a campaign to harvest patient data and more likely to be an inadvertent exposure that could be leveraged to collect information or perform insecure firmware updates. Regardless, because an exposure exists that is likely leaking PHI randomly or could be used in some scenarios for malicious updates, the exposure should be remediated as a priority (see recommendations below).

Recommendations:

• It is heavily recommended that organizations with this patient monitor block all access to the subnet 202.114.4.0/24 from their internal network, blocking devices from attempting to upgrade their firmware from a WAN server or send PII in the future.
• We have seen some OEM examples of the CONTEC CMS8000 where the default network configuration for the CMS can be modified. If this is possible, do not leverage the default 202.114.4.119 IP address for your CMS.
• If you do need to leverage a CMS for monitoring and providing updates to the CONTEC CMS8000 patient monitors or its white label variants, and must use the 202.114.4.119 hard-coded IP address, we recommend applying static routes and/or network segmentation to ensure that this traffic is routed only to your CMS and not externally.
• If not using the HL7 capabilities of the patient monitor, it is recommended blocking all network traffic outbound to 202.114.4.120 to prevent potential PII/PHI leakage.
• These patient monitors are still running vulnerable code that will always be attempting to connect to an externally routable IP address, so it is recommended to replace them with a more secure device unless the vendor modifies firmware to prevent this action in the future.

Full investigation published here.