ET POLICY Contec Health CMS8000 Patient Monitor Insecure Default CMS Protocol Server IP (CVE-2025-0626)

Query · suricata

flow:stateless,to_server;
target:src_ip;
Raw source ET POLICY Contec Health CMS8000 Patient Monitor Insecure Default CMS Protocol Server IP (CVE-2025-0626) · Suricata
Esc
Published by Emerging Threats Open ↗, licensed under BSD 3-Clause ↗. Line breaks added for readability; the rule is otherwise unchanged. 
alert tcp $HOME_NET any -> 202.114.4.119 [515:520] (
    msg:"ET POLICY Contec Health CMS8000 Patient Monitor Insecure Default CMS Protocol Server IP (CVE-2025-0626)";
    flow:stateless,to_server;
    reference:url,claroty.com/team82/research/are-contec-cms8000-patient-monitors-infected-with-a-chinese-backdoor-the-reality-is-more-complicated;
    reference:cve,2025-0626;
    classtype:policy-violation;
    sid:2059841; rev:2;
    metadata:attack_target Client_Endpoint, tls_state plaintext, created_at 2025_02_03, cve CVE_2025_0626, deployment Perimeter, deployment Internal, performance_impact Significant, confidence High, signature_severity Unknown, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2026_01_15;
    target:src_ip;
)

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.