MAUDE Adverse Event Report: CONTEC MEDICAL SYSTEMS CO. CONTEC CMS8000 ICS PATIENT MONITOR; MONITOR, CARDIAC (INCL. CARDIOTACHOMETER & RATE ALARM)

Model Number	CMS8000
Health Effect - Clinical Code	No Clinical Signs, Symptoms or Conditions (4582)
Type of Reportable Event	Malfunction
Event or Problem Description
There is a serious cyber security vulnerability in the contec cms8000 ics patient monitor.This vulnerability was discovered as part of our work with arpa-h (https://arpa-h.Gov/) under the digiheals (https://arpa-h.Gov/research-andfunding/programs/digiheals) program in an effort to improve hospital and medical device cybersecurity.This vulnerability was disclosed to cisa (https://www.Cisa.Gov/coordinated-vulnerability-disclosure-process) on july 24, 2024. = description = the cms800 device does not perform bounds checking while parsing network data sent by a threat actor.A threat actor with network access can remotely issue a specially formatted udp request that will allow them to write arbitrary data, leading to remote code execution (rce) with root privileges and persistence.Two sequential udp broadcast requests could be sent that cause a mass takeover of all cme8000 devices connected to the same network.(b)(4).

• Brand Name: CONTEC CMS8000 ICS PATIENT MONITOR
• Common Device Name: MONITOR, CARDIAC (INCL. CARDIOTACHOMETER & RATE ALARM)
• Manufacturer (Section D): CONTEC MEDICAL SYSTEMS CO.
• MDR Report Key: 20291070
• Report Number: MW5159958
• Device Sequence Number: 7429214
• Product Code: DRT
• Combination Product (Y/N): N
• Initial Reporter State: VA
• Initial Reporter Country: US
• Number of Events Summarized: 1
• Summary Report (Y/N): N
• Reporter Type: Voluntary
• Initial Reporter Occupation: Unknown
• Type of Report: Initial
• Report Date (Section B): 09/16/2024

1 Device was Involved in the Event

1 Patient was Involved in the Event

• Is this an Adverse Event Report?: No
• Is this a Product Problem Report?: Yes
• Device Model Number: CMS8000
• Was Device Available for Evaluation?: Yes
• Initial Date Received by Manufacturer: Not provided
• Initial Report FDA Received Date: 09/20/2024
• Patient Sequence Number: 1
• Patient Sex: Unknown