CVE-2025-0683

MediumCVSS 5.9/10Last modified Jun 17, 2026

Description

In its default configuration, Contec Health CMS8000 Patient Monitor transmits plain-text patient data to a hard-coded public IP address when a patient is hooked up to the monitor. This could lead to a leakage of confidential patient data to any device with that IP address or an attacker in a machine-in-the-middle scenario.

Metrics

CVSS 3.1 5.9/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-359

Affected software

No affected versions have been published.

Timeline

Published: Jan 30, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-06846.4A flaw was found in grub2. When performing a symlink lookup from a reiserfs filesystem, grub's reiserfs fs module uses user-controlled param CVE-2025-06856.4A flaw was found in grub2. When reading data from a jfs filesystem, grub's jfs filesystem module uses user-controlled parameters from the fi CVE-2025-06866.4A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled par CVE-2025-06876.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o CVE-2025-06886.1The Spiritual Gifts Survey (and optional S.H.A.P.E survey) WordPress plugin through 0.9.10 does not sanitise and escape a parameter before o CVE-2025-06897.8When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buf CVE-2025-06906.1The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is CVE-2025-06915.0Improper access control in permissions component in Devolutions Server 2025.1.10.0 and earlier allows an authenticated user to bypass the "E CVE-2025-06923.5The Simple Video Management System WordPress plugin through 1.0.4 does not sanitise and escape some of its settings, which could allow high CVE-2025-06935.3Variable response times in the AWS Sign-in IAM user login flow allowed for the use of brute force enumeration techniques to identify valid I CVE-2025-06946.6Insufficient path validation in CODESYS Control allows low privileged attackers with physical access to gain full filesystem access.CVE-2025-06955.3An Allocation of Resources Without Limits or Throttling vulnerability in Cesanta Frozen versions less than 1.7 allows an attacker to induce