Agencies Sound Alarm on Patient Monitors With Hardcoded Backdoor

CISA and the FDA issued alerts about Contec CMS8000 and Epsimed MN-120 patient monitors that appear to contain a backdoor allowing remote control, network pivoting, and potential exfiltration of patient data; Claroty Team82's firmware research contends this is more likely insecure design (hardcoded CMS IP and exposed upgrade flow) than deliberate malware and recommends blocking WAN firmware upgrades, network segmentation, and robust vulnerability detection and patching to protect patients and networks.