CVE-2025-0683

CVE-2025-0683 describes a critical data leakage vulnerability in Contec Health CMS8000 Patient Monitors, where patient data is transmitted in plain-text to a hard-coded public IP address by default. This medium-severity vulnerability (CVSS 5.9) allows for remote, unauthenticated attackers to intercept sensitive patient information with high confidentiality impact, particularly in man-in-the-middle scenarios or if the receiving IP address is compromised. While there is no known active exploitation or public exploit code, the vulnerability has garnered significant community discussion and media coverage, indicating a high level of concern despite its inactive status on the CISA Hot List.