CVE-2024-12248: Contec CMS8000 Patient Monitor Out-of-Bounds Write Enables Remote Code Execution

CVE-2024-12248 is an out-of-bounds write vulnerability (CWE-787) in Contec Health's CMS8000 patient monitor — a bedside vital-signs monitor also sold rebadged as the Epsimed MN-120 — that lets a remote attacker send specially formatted UDP requests to the device and write arbitrary data, which CISA's ICS-CERT assesses 'could allow an attacker to ... write arbitrary data, resulting in remote code execution'; NVD has not yet published its own Primary CVSS score, so this page does not present a headline severity figure as NVD-confirmed.

CVE-2024-12248 (CWE-787, out-of-bounds write) affects Contec Health's CMS8000 patient monitor, a bedside vital-signs monitor used to track ECG, SpO2, blood pressure and other parameters; CISA's advisory lists it as also sold rebadged as the Epsimed MN-120. NVD's description states: "Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data. This could result in remote code execution" (NVD).

NVD tracks CVE-2024-12248 with status "Deferred": it records only a CISA ICS-CERT-submitted Secondary score (source [email protected]) of CVSS v3.1 9.8 (critical) and CVSS v4.0 9.3 — not NVD's own Primary rating — so this page does not present a headline figure as NVD-confirmed (NVD).

CISA's advisory ICSMA-25-030-01 bundles CVE-2024-12248 with three related CMS8000 flaws disclosed the same week — CVE-2025-0626, CVE-2025-0683 and CVE-2025-1204 — and separately describes an embedded backdoor function with a hard-coded IP address, categorized as hidden functionality (CWE-912), through which the device can leak patient information and sensor data to an unknown external network (CISA ICS Medical Advisory ICSMA-25-030-01; CISA: Contec CMS8000 Contains Backdoor).

CISA assesses the patient-safety stakes directly: inclusion of the hidden functionality in the firmware "can create conditions which may allow remote code execution and device modification ... introducing risk to patient safety as a malfunctioning patient monitor could lead to an improper response to patient vital signs" (CISA: Contec CMS8000 Contains Backdoor).

The FDA issued its own safety communication covering the same device family, identifying that the monitor "may be remotely controlled by an unauthorized user or not work as intended," that it contains hidden functionality letting an attacker "bypass cybersecurity controls, gaining access to and potentially manipulating the device," and that once connected to the internet the monitors collect and transmit patient data including personally identifiable information and protected health information. The FDA states it is "not aware of any cybersecurity incidents, injuries, or deaths related to these" issues, and recommends facilities use only local, non-internet-connected monitoring or remove the devices entirely, echoing CISA's guidance to "remove any Contec CMS8000 devices from their networks" where feasible (FDA Safety Communication; CISA ICS Medical Advisory ICSMA-25-030-01).

CISA headquarters the vendor in China and lists worldwide deployment in the Healthcare and Public Health sector; CVE-2024-12248, CVE-2025-0626 and CVE-2025-0683 were reported by an anonymous researcher, while the companion CVE-2025-1204 was reported by Claroty Team82 (CISA ICS Medical Advisory ICSMA-25-030-01).

This CVE is not listed in the CISA Known Exploited Vulnerabilities catalog as of catalog version 2026.11.06, and FIRST scores the probability of exploitation at 0.0129 (70.4th percentile) as of 2026-11-07 — one of the higher EPSS percentiles in this corpus, consistent with a device backdoor that drew sustained public attention (CISA KEV, FIRST EPSS).

NVD has not finished its own severity analysis. In the meantime, facilities operating a Contec CMS8000 or rebadged Epsimed MN-120 monitor should follow CISA and FDA guidance: disconnect the device from the internet and any wireless network, use only local bedside monitoring, and apply Contec's July 2025 software patch where remote monitoring functionality is still required.

• Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write via specially formatted UDP requests, which could result in remote code execution. — NVD
• NVD status is 'Deferred' with only a CISA ICS-CERT Secondary submission of CVSS v3.1 9.8 and CVSS v4.0 9.3; no NVD-published Primary score. — NVD
• CISA advisory ICSMA-25-030-01 bundles CVE-2024-12248 with CVE-2025-0626, CVE-2025-0683 and CVE-2025-1204; documents a hard-coded-IP-address backdoor (CWE-912) that can leak patient information to an unknown external network; affects Healthcare and Public Health sector worldwide, China-headquartered vendor. — CISA ICS Medical Advisory ICSMA-25-030-01
• Inclusion of the backdoor in firmware can allow remote code execution and device modification, introducing risk to patient safety because a malfunctioning monitor could lead to an improper response to patient vital signs. — CISA: Contec CMS8000 Contains Backdoor
• The monitor may be remotely controlled by an unauthorized user, contains hidden functionality that can bypass cybersecurity controls, and transmits patient PII/PHI once connected to the internet; FDA is not aware of related incidents, injuries, or deaths; recommends local-only monitoring or device removal. — FDA Safety Communication
• Not present in the CISA KEV catalog as of catalog version 2026.11.06; EPSS score is 0.0129 (70.4th percentile) as of 2026-11-07. — FIRST EPSS