Security vulnerabilities in medical devices: Danger through backdoor access

Networked medical devices FDA discovers cybersecurity vulnerabilities in patient monitors

2025-02-06 From | Translated by AI 1 min Reading Time

The networking of medical devices offers many advantages but also entails risks. A recent FDA investigation reveals serious security vulnerabilities in patient monitors, including a backdoor that allows unauthorized access.

The FDA has discovered cybersecurity vulnerabilities in patient monitors from Chinese production.(Image: freely licensed / Pixabay) — The FDA has discovered cybersecurity vulnerabilities in patient monitors from Chinese production.
(Image: freely licensed / Pixabay)

The FDA has identified three critical security vulnerabilities in medical patient monitors. Attackers have the possibility to remotely control and manipulate the device. Particularly concerning is the discovered backdoor, which not only jeopardizes the patient monitoring itself but also has the potential to compromise the IT security of the entire network.

The patient monitor refers to the CMS8000 models and the identical model sold under a different name, Epsimed MN-120. The CMS8000 is a multi-parameter patient monitor from the manufacturer Contec Medical Systems, designed for monitoring vital signs in adults, children, and newborns in clinical environments such as intensive care units, hospitals, and clinics. Contec is based in Qinhuangdao, one of the largest development and production sites for medical technology in China.

Compromised patient safety

The backdoor discovered by the FDA threatens patient monitoring and could compromise the entire network. Once the device is connected to the internet, the backdoor can unlawfully capture and transmit personal patient information (PII—Personally Identifiable Information) as well as protected health information (PHI—Protected Health Information). This poses the risk of sensitive data being leaked from the protected clinical environment.

The US authorities recommend operating the affected patient monitors exclusively in local mode without an internet connection to prevent unauthorized access. For manufacturers and developers of medical devices, this means an increased need to integrate security mechanisms at the hardware and firmware level to prevent potential cyberattacks early on.

Not the only security problem

Cybersecurity vulnerabilities in medical devices from China are not uncommon. A study found that many medical devices purchased by national health services had 661 different vulnerabilities. More than half of these are critical or very severe. Additionally, 82% of health systems reported cyberattacks on IoMT devices (Internet of Medical Things). The increasing connectivity of medical devices significantly raises the risk of cyberattacks. (heh)

Subscribe to the newsletter now

Don't Miss out on Our Best Content

Business E-mail

Please enter a valid mailadress.

By clicking on „Subscribe to Newsletter“ I agree to the processing and use of my data according to the consent form (please expand for details) and accept the Terms of Use. For more information, please see our Privacy Policy. The consent declaration relates, among other things, to the sending of editorial newsletters by email and to data matching for marketing purposes with selected advertising partners (e.g., LinkedIn, Google, Meta)

Date: 08.12.2025

Naturally, we always handle your personal data responsibly. Any personal data we receive from you is processed in accordance with applicable data protection legislation. For detailed information please see our privacy policy.

Consent to the use of data for promotional purposes

I hereby consent to Vogel Communications Group GmbH & Co. KG, Max-Planck-Str. 7-9, 97082 Würzburg including any affiliated companies according to §§ 15 et seq. AktG (hereafter: Vogel Communications Group) using my e-mail address to send editorial newsletters. A list of all affiliated companies can be found here

Newsletter content may include all products and services of any companies mentioned above, including for example specialist journals and books, events and fairs as well as event-related products and services, print and digital media offers and services such as additional (editorial) newsletters, raffles, lead campaigns, market research both online and offline, specialist webportals and e-learning offers. In case my personal telephone number has also been collected, it may be used for offers of aforementioned products, for services of the companies mentioned above, and market research purposes.

Additionally, my consent also includes the processing of my email address and telephone number for data matching for marketing purposes with select advertising partners such as LinkedIn, Google, and Meta. For this, Vogel Communications Group may transmit said data in hashed form to the advertising partners who then use said data to determine whether I am also a member of the mentioned advertising partner portals. Vogel Communications Group uses this feature for the purposes of re-targeting (up-selling, cross-selling, and customer loyalty), generating so-called look-alike audiences for acquisition of new customers, and as basis for exclusion for on-going advertising campaigns. Further information can be found in section “data matching for marketing purposes”.

In case I access protected data on Internet portals of Vogel Communications Group including any affiliated companies according to §§ 15 et seq. AktG, I need to provide further data in order to register for the access to such content. In return for this free access to editorial content, my data may be used in accordance with this consent for the purposes stated here. This does not apply to data matching for marketing purposes.

Right of revocation

I understand that I can revoke my consent at will. My revocation does not change the lawfulness of data processing that was conducted based on my consent leading up to my revocation. One option to declare my revocation is to use the contact form found at https://contact.vogel.de. In case I no longer wish to receive certain newsletters, I have subscribed to, I can also click on the unsubscribe link included at the end of a newsletter. Further information regarding my right of revocation and the implementation of it as well as the consequences of my revocation can be found in the data protection declaration, section editorial newsletter.