Cyber Flaws in Home and Hospital Patient Monitors Could Risk Privacy and Safety, FDA Warns

A new software update is addressing serious cybersecurity flaws in widely used patient monitoring devices, but residents using these monitors at home or health facilities should act with caution. The FDA is warning that the Contec CMS8000 and Epsimed MN-120 monitors may expose sensitive health data to unauthorized access when connected to the internet, potentially risking patient privacy and safety.

The vulnerabilities include the possibility of remote control by unauthorized users, data exfiltration involving protected health and personal information, and the existence of a software backdoor. These risks affect devices used in hospitals, clinics, and even home settings. To mitigate these threats, Contec has issued a software patch that disables all network features, effectively restricting the devices to only local monitoring. However, the FDA has made it clear that patients and caregivers should not attempt to install the patch themselves due to its technical complexity.

Healthcare facilities are instructed to request the patch directly from Contec and ensure installation is handled by trained IT or cybersecurity staff. For those unable to apply the patch, strict guidelines remain in place: unplug ethernet cables, disable wireless connections, and discontinue use entirely if wireless functions can’t be turned off. Continued internet connectivity could result in data being transmitted outside of secure healthcare environments.

While the FDA has not received any reports of harm, incidents, or data breaches so far, it emphasizes that affected users—especially those relying on remote monitoring features—should stop using the devices and consult healthcare providers for alternatives. Facilities should monitor for any unusual readings and report any discrepancies to the FDA. The patch release represents a partial fix, but full restoration of safe remote functionality has not yet been achieved.

The devices in question include Contec CMS8000 (UDI-DI: 06945040100034) and Epsimed MN-120 monitors, which are relabeled versions of the same hardware. These monitors were only cleared by the FDA for wired use, yet some have been marketed with unauthorized wireless capabilities, further compounding the risk.

Article by multiple contributors, based upon information from the U.S. Food and Drug Administration press release.

---