CVE-2025-0626

High

Published: 30 January 2025

Published

30 January 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0008 24.4th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0626 is a high-severity Hidden Functionality (CWE-912) vulnerability in Cisa (inferred from references). Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Ingress Tool Transfer (T1105); ranked at the 24.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-7 (Least Functionality) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Ingress Tool Transfer (T1105) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match

prevent

SI-2 requires timely identification, reporting, and correction of flaws such as the hard-coded backdoor in the monitor binary firmware.

CM-7 Least Functionality good match

prevent

CM-7 prohibits nonessential system capabilities like the monitor binary's hard-coded IP mount and automatic network interface enabling.

SC-7 Boundary Protection partial match

prevent

SC-7 monitors and controls communications at system boundaries, mitigating unauthorized outbound connections to the hard-coded routable IP.

MITRE ATT&CK Enterprise TechniquesAI

T1105 Ingress Tool Transfer Command And Control

Adversaries may transfer tools or other files from an external system into a compromised environment.

attack.mitre.org →

T1021.002 SMB/Windows Admin Shares Lateral Movement

Adversaries may use [Valid Accounts](https://attack.

attack.mitre.org →

T1133 External Remote Services Persistence

Adversaries may leverage external-facing remote services to initially access and/or persist within a network.

attack.mitre.org →

Why these techniques?

Vulnerability creates hardcoded backdoor network share mount (bypassing config and enabling interface) that directly enables unauthenticated remote file upload/overwrite on device, mapping to ingress tool transfer and remote share/service access.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

NVD Description

The "monitor" binary in the firmware of the affected product attempts to mount to a hard-coded, routable IP address, bypassing existing device network settings to do so. The function also enables the network interface of the device if it is…

disabled. The function is triggered by attempting to update the device from the user menu. This could serve as a backdoor to the device, and could lead to a malicious actor being able to upload and overwrite files on the device.

Deeper analysisAI

CVE-2025-0626 is a vulnerability in the "monitor" binary within the firmware of Contec CMS8000 patient monitors and certain patient monitors from Contec and Epsimed. When triggered by a user attempting a device update from the menu, the binary attempts to mount a network share to a hard-coded, routable IP address, bypassing the device's existing network settings. It also automatically enables the network interface if it is disabled. This functionality effectively creates a backdoor, enabling potential file upload and overwrite capabilities on the device.

The vulnerability can be exploited by any unauthenticated attacker (PR:N) with network access (AV:N) who can induce user interaction (UI:R), such as tricking a user into selecting the update option via the device menu; exploitation involves high complexity (AC:H). Successful exploitation grants high-impact confidentiality, integrity, and availability effects (C:H/I:H/A:H), with an overall CVSS v3.1 score of 7.5, allowing attackers to upload and overwrite files, potentially leading to full device compromise.

Advisories from CISA (ICSMA-25-030-01 and resources on Contec CMS8000) and FDA safety communications detail cybersecurity vulnerabilities in these patient monitors and provide mitigation guidance.

The backdoor connects to an IP address linked to China, as noted in security reporting, highlighting risks in healthcare device firmware supply chains.