CVE-2024-12248

Published Jan 30, 2025

Last updated a month ago

CVSS critical 9.3

Overview

Description
Contec Health CMS8000 Patient Monitor is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data. This could result in remote code execution.
Source
ics-cert@hq.dhs.gov
NVD status
Received

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

ics-cert@hq.dhs.gov
CWE-787

Social media

Hype score
Not currently trending

  1. Actively exploited CVE : CVE-2024-12248

    @transilienceai

    10 Feb 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  2. Actively exploited CVE : CVE-2024-12248

    @transilienceai

    9 Feb 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. Actively exploited CVE : CVE-2024-12248

    @transilienceai

    7 Feb 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. Actively exploited CVE : CVE-2024-12248

    @transilienceai

    6 Feb 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. Actively exploited CVE : CVE-2024-12248

    @transilienceai

    5 Feb 2025

    7 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  6. Actively exploited CVE : CVE-2024-12248

    @transilienceai

    4 Feb 2025

    3 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  7. U.S. CISA & FDA warn of a hidden backdoor in Contec CMS8000 & Epsimed MN-120 patient monitors. Critical flaws (CVE-2025-0626, CVE-2025-0683, CVE-2024-12248) risk unauthorized access, patient data leaks & RCE. #Vulnerability #CyberSecurity #hackinginquiry https://t.co

    @kevin___hack

    1 Feb 2025

    67 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. U.S. CISA & FDA warn of a hidden backdoor in Contec CMS8000 & Epsimed MN-120 patient monitors. Critical flaws (CVE-2025-0626, CVE-2025-0683, CVE-2024-12248) risk unauthorized access, patient data leaks & RCE. #Vulnerability #CyberSecurity #hackinginquiry https://t.co

    @dean95196196583

    1 Feb 2025

    50 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. U.S. CISA & FDA warn of a hidden backdoor in Contec CMS8000 & Epsimed MN-120 patient monitors. Critical flaws (CVE-2025-0626, CVE-2025-0683, CVE-2024-12248) risk unauthorized access, patient data leaks & RCE. https://t.co/DXJpxkexAd #Vulnerability #CyberSecurity #Hac

    @hackingspace

    1 Feb 2025

    469 Impressions

    3 Retweets

    7 Likes

    0 Bookmarks

    2 Replies

    1 Quote

  10. CVE-2024-12248 The affected product is vulnerable to an out-of-bounds write, which could allow an attacker to send specially formatted UDP requests in order to write arbitrary data.… https://t.co/U7cbENjtrl

    @CVEnew

    30 Jan 2025

    329 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References