The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Food and Drug Administration (FDA) have issued urgent warnings regarding severe security vulnerabilities in Contec CMS8000 and Epsimed MN-120 patient monitors, manufactured by China-based Contec Medical Systems. These devices, widely used in the U.S. and internationally, contain a hidden backdoor, tracked as CVE-2025-0626, that allows unauthorized remote access to a hard-coded IP address linked to a third-party university, enabling attackers to upload, overwrite, and execute files on the devices without logging any activity. Additionally, a privacy leakage flaw, tracked as CVE-2025-0683, causes patient data, including personally identifiable information (PII) and protected health information (PHI), to be transmitted in plaintext to this hard-coded address, raising concerns over data breaches and adversary-in-the-middle (AiTM) attacks. A third critical vulnerability, tracked as CVE-2024-12248, enables remote attackers to execute arbitrary code through an out-of-bounds write exploit. These flaws pose significant patient safety risks, as compromised monitors could manipulate vital sign readings, potentially leading to misdiagnoses or improper medical responses. Despite multiple firmware updates from Contec, the backdoor persists, with only superficial mitigations that fail to eliminate the exploit. No patches are currently available, prompting CISA and the FDA to strongly advise healthcare providers to disconnect all affected devices from networks, disable wireless connectivity where possible, and monitor them for anomalies. Furthermore, past CISA reports from 2022 identified additional vulnerabilities in Contec CMS8000 devices, including root shell access, denial-of-service (DoS) risks, and hard-coded credentials, further highlighting the long-standing cybersecurity risks associated with these monitors. Given the lack of effective remediation, healthcare organizations are urged to cease using these devices to protect both patient safety and data security. CTIX analysts urge any healthcare entities deploying the affected devices to follow the CISA/FDA guidance, and monitor for when security patches are released.