Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
5 results
Sep 13, 2022The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point.CVE-2022-3027 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 5.7
The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings.CVE-2022-38453 · Other software · Contec Health · reported by ics-cert@hq.dhs.govLow 3
Multiple binary application files on the CMS8000 device are compiled with 'not stripped' and 'debug_info' compilation settings. These compiler settings greatly decrease the level of effort for a threat actor to reverse engineer sensitive code and identify additional vulnerabilities.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022The CMS800 device fails while attempting to parse malformed network data sent by a threat actor.CVE-2022-38100 · Other software · Contec Health · reported by ics-cert@hq.dhs.govHigh 7.5
The CMS800 device fails while attempting to parse malformed network data sent by a threat actor. A threat actor with network access can remotely issue a specially formatted UDP request that will cause the entire device to crash and require a physical reboot. A UDP broadcast request could be sent that causes a mass denial-of-service attack on all CME8000 devices connected to the same network.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privilegeCVE-2022-38069 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 4.3
Multiple globally default credentials exist across all CMS8000 devices, that once exposed, allow a threat actor with momentary physical access to gain privileged access to any device. Privileged credential access enables the extraction of sensitive patient information or modification of device parameters
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 13, 2022A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device funCVE-2022-36385 · Other software · Contec Health · reported by ics-cert@hq.dhs.govMedium 6.8
A threat actor with momentary access to the device can plug in a USB drive and perform a malicious firmware update, resulting in permanent changes to device functionality. No authentication or controls are in place to prevent a threat actor from maliciously modifying firmware and performing a drive-by attack to load the firmware on any CMS8000 device.
- Product
- CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.