A serious security flaw in widely used medical devices could expose patient data in Moroccan hospitals and clinics, according to a report by BleepingComputer.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified the vulnerability in Contec CMS8000 devices, raising concerns about potential data breaches.
Experts warn that these devices contain a hidden “backdoor” that allows sensitive information to be accessed remotely.
These machines, commonly used in hospitals to monitor patient health, were found secretly sending patient data to a fixed IP address in China.
This flaw could allow external parties to not only access sensitive medical records but also remotely control the devices.
The discovery was first reported by cybersecurity researchers and later confirmed by CISA, which tested multiple software versions of the affected devices.
Their findings revealed unusual data traffic to an unidentified university-linked IP address.
Cybersecurity expert Tayeb Hazzaz told Hespress Ar that this issue is not just a global concern—it directly affects Morocco’s healthcare sector.
Many private clinics and public hospitals in the country use these devices, making them vulnerable to data theft and possible external control.
Hazzaz said that the backdoor could expose critical patient information, including names, health conditions, and medical histories, to unauthorized entities.
Even more alarming, the flaw allows remote control of the equipment without warning, creating serious risks for patient safety.
The expert urged Moroccan authorities, particularly the Commission for the Protection of Personal Data, to take action to prevent potential data breaches. He recommended immediate disconnection of affected devices from the internet and stronger cybersecurity measures for hospital infrastructure.
The company behind the compromised devices, China-based Contec, specializes in healthcare technology and produces a range of medical monitoring systems.
Security researchers from “BleepingComputer” said that the company’s firmware contains a hidden function that enables remote file downloads and execution, effectively handing over full control of the devices to outside parties.
CISA’s analysis of the device’s software code concluded that the backdoor was unlikely to be part of a standard update system.
add your comment
Terms of publication : Not to offend the writer, people, sacred things, or attack religions or the divine self, and refrain from racist incitement and insults.