Cookies Notice

Security Advisory & Archive

• Advisory

  Archive

• EDAN Patient Monitor default use of publicly routable IP vulnerability

  2026-07-09

  Overview of Vulnerabilities:
  In the user maintenance operation interface of EDAN’s patient monitoring devices, the default configuration upon factory production uses an inappropriate public IP address (202.114.4.XXX). This IP address is not hardcoded in the system and can be modified by users through the user maintenance operation interface. The user manual used an inappropriate public IP address (202.114.4.XXX) as an example to demonstrate the IP address configuration feature. This approach was originally designed for small isolated networks, but it has introduced potential security vulnerabilities.
  
  If the user uses the default IP address of the patient monitoring device, the attacker may exploit the unexpected communication between the device and the external public IP address, which may result in:
  • Disruption of the continuous monitoring of vital signs, leading to delay in the detection of critical changes in a patient's health condition and delayed medical intervention.
  • Manipulation or corruption of data being transmitted by the device, leading to incorrect readings that may lead to potentially harmful medical decisions (i.e., incorrect diagnosis and/or treatment plan) based on false data
  
  As of now, EDAN has not observed any network attacks, unauthorized access to patient data, or any incidents that may have caused harm to patients related to this discovery.
  
  CVSS Score:
  According to the CVSS 3.1 assessment, the CVSS 3.1 score of this vulnerability is 3.8, with a level of Low; the CVSS vector string is: CVSS:3.1/AV:P/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N
  According to the CVSS 4.0 assessment, the CVSS 4.0 score of this vulnerability is 4.1, with a level of Medium; the CVSS vector string is: CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N.
  
  The affected product:
  

  Product Name	Product Model	Model Number
  Fetal & Maternal Monitor	F9, F9 Express	Versions prior to V03.00.01
  Fetal & Maternal Monitor	F6, F6 Express	Versions prior to V02.00.01
  Fetal & Maternal Monitor	F2, F3	Versions prior to V01.07.02
  Patient Monitor	iV100	Versions prior to V1.2.1
  Patient Monitor	iV12, iV15, iV17	Version 1: Versions prior to V1.30 Version 02: Versions prior to V02.01.0
  Patient Monitor	iX10, iX12, iX15	Versions prior to V1.5.1
  Patient Monitor	CX10, CX12, CX15	Versions prior to V1.2.0
  Patient Monitor	X8, X10, X12	Versions prior to V2.2.0
  Patient Monitor	elite V5, elite V6, elite V8	Versions prior to V2.4.0
  Vital Signs Monitor	iM20	Versions prior to V2.3.0
  Vital Signs Monitor	iM50, iM60, iM70, iM80	Versions prior to V2.3.0
  Vital Signs Monitor	iM8, iM8A, iM8B	Versions prior to V1.33
  Vital Signs Monitor	iM3	Versions prior to V01.08.00
  Vital Signs Monitor	iM3s	Versions prior to V1.52
  Vital Signs Monitor	M3, M3B	Versions prior to V1.07
  Vital Signs Monitor	M3A	Versions prior to V1.3.0
  Telemetry Transmitter	iT20	Versions prior to V1.4.1
  Telemetry Monitor	iT30, iT50	Versions prior to V1.3.3
  Patient Monitor	UX10, UX12	Versions prior to V01.02.00
  Central Monitoring System	MFM-CMS	Versions prior to V02.04.00.05
  Central Monitoring System	MFM-CNS	Versions prior to V4.30
  Central Monitoring System	MFM-CMS Lite	Versions prior to V1.40

  
  Disposition Measures:
  Confirm the publicly routable IP address 202.114.4.* is NOT used as the device IP. If 202.114.4.* is being used, please change the device's IP address to a suitable private IP address.
  
  More Information:
  For more information, please contact our service team at https://www.edan.com/Service/ or support@edan.com.

  Close

• Cybersecurity Vulnerabilities with Certain Patient Monitors from Contec and Epsimed

  2025-1-30

  On January 30, 2025, the FDA issued a safety communication highlighting cybersecurity vulnerabilities in the Contec CMS8000 and Epsimed MN-120 patient monitors. On the same day, CISA released a fact sheet detailing a backdoor vulnerability in the Contec CMS8000 firmware. Testing revealed that the affected firmware version can mount a remote NFS share from an IP address that is not registered to the device manufacturer but is instead associated with a university. This configuration may allow unauthorized remote access, posing potential risks to device integrity and patient data security. We have conducted an exhaustive review of our patient monitors. At this time, no EDAN patient monitors are known to exhibit the backdoor vulnerability. EDAN continues to analyze the matter, and further information will be posted on the EDAN Product Security Advisory page as appropriate. If you feel you have been exposed to the backdoor vulnerability and would like more information, please contact EDAN Technical Support group.

  Learn more +

• Apache Log4j2

  2021-12-10

  On December 10, 2021, a high severity vulnerability (CVE-2021-44228) referred to as Log4j2 was published on CVE which impacts Apache Log4j2. The exploitation of vulnerabilities can cause unauthenticated remote code execution. At this time, no EDAN products are known to be impacted. EDAN continues to analyze the matter, and further information will be posted on the EDAN Product Security Advisory page as appropriate. If you feel you have been exposed to this vulnerability and would like more information, please contact EDAN Technical Support group.

  Learn more +

• Urgent/11

  2019-10-1

  On October 1, 2019, the FDA issued a safety communication regarding the URGENT/11 cybersecurity vulnerabilities. These vulnerabilities exist in IPnet, a third-party software component that supports network communications. IPNet is utilized in several real-time operating systems which may be incorporated into some medical devices. At this time, no EDAN products are known to be impacted. EDAN continues to analyze the matter, and further information will be posted on the EDAN Product Security Advisory page as appropriate. If you feel you have been exposed to these vulnerabilities and would like more information, please contact EDAN Technical Support group.

  Learn more +

• KRACK WPA2 vulnerability

  2017-10-20

  A vulnerability in the WPA2 security protocol has recently been acknowledged. This vulnerability, known as “KRACK” for Key Reinstallation Attacks, exposes a weakness in the WPA2 security protocol. The WPA2 protocol is the recommended method for protecting and securing access to Wi-Fi devices. As of this writing, EDAN has not received reports of Edan devices impacted by this KRACK vulnerability. EDAN is working closely with our suppliers to implement solutions as they become available. If additional information is required, please contact Edan Technical Support group.

  Learn more +

• Petya Malware

  2017-7-2

  The Petya Malware was first identified in March 2016. Microsoft addressed the vulnerabilities exploited by Petya Malware in the Microsoft Patch (MS17-010). EDAN has evaluated this patch and is ready to deploy where applicable. If you feel you have been exposed to Petya Malware and would like more information, please contact EDAN Technical Support group.

  Learn more +

• WannaCry Worm

  2017-5-15

  The WannaCry Worm identified in May, 2017 impacted Windows Operating Systems around the world. Microsoft released a patch (MS17-010) to address the vulnerabilities exploited by the WannaCry Worm. EDAN has evaluated this patch and is ready to deploy where applicable. If you feel you have been exposed to WannaCry and woEuld like more information, please contact EDAN Technical Support group.

  Learn more +