Backdoor in Chinese-made healthcare monitoring device leaks patient data

[Anonymous]

US federal agencies have warned that a popular Chinese-made patient monitor device used in medical settings across the US and Europe has a built-in backdoor that leaks patient data to an unauthorized remote server. The backdoor, present also in a rebranded version of the device, also allows the remote server, which appears to belong to a university, to execute unauthorized code on the device.

The backdoor was discovered by the US Cybersecurity and Infrastructure Security Agency (CISA) after it received a report about a vulnerability in Contec CMS8000 from an external researcher.

In reviewing the vulnerability report, CISA researchers analyzed the device’s firmware, which led to the discovery of suspicious functionality inside the firmware code that reached out to a hardcoded IP address. That IP address was not registered to the device manufacturer or a medical facility; instead, it appears to belong to a third-party university. CISA did not disclose the IP address nor the name of the university in its report.

In addition to this hidden remote code execution behavior, CISA also found that once the CMS8000 completes its startup routine, it also connects to that same IP address over port 515, which is normally associated with the Line Printer Daemon (LPD), and starts transmitting patient information without the device owner’s knowledge.

“The research team created a simulated network, created a fake patient profile, and connected a blood pressure cuff, SpO2 monitor, and ECG monitor peripherals to the patient monitor,” the agency said. “Upon startup, the patient monitor successfully connected to the simulated IP address and immediately began streaming patient data to the address.”

https://www.csoonline.com/article/3814810/backdoor-in-chinese-made-healthcare-monitoring-device-leaks-patient-data.html

https://www.cisa.gov/sites/default/files/2025-01/fact-sheet-contec-cms8000-contains-a-backdoor-508c.pdf

[Anonymous]

A while ago I bought a sleep monitor device that you wear on your wrist, cost around $300. You need to download an app of course, which is when I discovered it was Chinese software. Sent it back. This is why Tik Tok needs to go.

[Anonymous]

ANYTHING that is digital electronic and connected to wifi, G-cell, etc. is sending all it's data to at least 1 or more places, then probably selling that data or trading it with government(s). Gyroscopes, movement, microphone, video, etc. all being used.

To deny this is to validate it further.