CVE-2022-36385 : What You Need to Know

This article provides an in-depth analysis of CVE-2022-36385, a vulnerability affecting Contec Health CMS8000 ICU CCU Vital Signs Patient Monitor.

Understanding CVE-2022-36385

CVE-2022-36385 poses a significant risk due to a lack of authentication controls, allowing threat actors to perform malicious firmware updates via USB drives.

What is CVE-2022-36385?

The vulnerability in Contec Health CMS8000 enables threat actors with temporary access to the device to alter firmware, leading to permanent changes in device functionality without any authentication barriers.

The Impact of CVE-2022-36385

With a CVSS base score of 6.8 and high impacts on availability, confidentiality, and integrity, this vulnerability can result in severe consequences if exploited. Attackers can execute drive-by attacks on any CMS8000 device.

Technical Details of CVE-2022-36385

The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS v3.1 base severity of MEDIUM. The attack vector is physical, with low complexity, and no user interaction or privileges are required.

Vulnerability Description

A threat actor can modify the device's firmware through a USB drive, leading to permanent alterations in device functionality without any authentication obstacles in place.

Affected Systems and Versions

All versions of the CMS8000 CONTEC ICU CCU Vital Signs Patient Monitor are affected by this vulnerability.

Exploitation Mechanism

By exploiting the lack of authentication controls, threat actors can perform malicious firmware updates via USB drives, potentially executing drive-by attacks on vulnerable devices.

Mitigation and Prevention

The following steps can help mitigate the risk associated with CVE-2022-36385:

Immediate Steps to Take

Disable UART functionality at the CPU level
Enforce unique device authentication before granting access to the terminal / bootloader
Implement secure boot mechanisms
Use tamper stickers on the device casing to detect unauthorized access.

Long-Term Security Practices

It is crucial to collaborate with Contec Health to address these vulnerabilities. Regularly update firmware and apply patches to safeguard against potential exploits.