FDA announces software patch available for Contec, Epsimed patient monitors to address vulnerabilities

The Food and Drug Administration yesterday released a safety notice announcing a software patch is available to address cybersecurity vulnerabilities in certain Contec and Epsimed patient safety monitors. The patch completely removes networking functionality from the affected devices, making them functional for local monitoring only.

The Cybersecurity and Infrastructure Security Agency and FDA in January announced they discovered the monitors could be remotely controlled by an unauthorized user or not work as intended. The software also had a backdoor, potentially compromising networks the monitors may have been connected to. The announcement said the backdoor provided automated connectivity to an IP address linked to a third-party university.

The FDA said patients, caregivers and health care providers should not install the software patch themselves as it requires specialized expertise. The agency advised users to instead follow recommendations previously issued when the vulnerabilities were announced. The FDA advised health care facility staff to contact Contec at [email protected] for the patch and installation instructions.