{"id":"CVE-2022-3027","aliases":["EUVD-2022-42461","GHSA-q7x7-x9qf-5p7c"],"status":"published","title":"Contec Health CMS8000","description":"The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.","severity":{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00324,"percentile":0.25668,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-284"],"published":"2022-09-13T14:54:58Z","modified":"2026-06-17T04:58:39Z","products":[{"vendor":"contec health","product":"cms8000 contec icu ccu vital signs patient monitor"},{"vendor":"contechealth","product":"cms8000_firmware"}],"references":[{"url":"https://www.cisa.gov/uscert/ics/advisories/icsma-22-244-01","tags":["x_refsource_MISC","x_transferred","Mitigation","Third Party Advisory","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-3027"},{"url":"https://github.com/advisories/GHSA-q7x7-x9qf-5p7c"}],"sources":{"cve":[{"id":"CVE-2022-3027","title":"Contec Health CMS8000","description":"The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.","status":"published","published":"2022-09-13T14:54:58.631Z","modified":"2025-04-16T16:10:02.402Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:34:33.24035Z"}],"euvd":[{"id":"EUVD-2022-42461","description":"The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.","status":"published","published":"2022-09-13T14:54:58Z","modified":"2025-04-16T16:10:02Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:24.837818Z"}],"ghsa":[{"id":"GHSA-q7x7-x9qf-5p7c","title":"The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access...","description":"The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.","status":"published","published":"2022-09-14T00:00:48Z","modified":"2023-02-02T05:00:43Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T14:51:01.770569Z"}],"nvd":[{"id":"CVE-2022-3027","description":"The CMS8000 device does not properly control or sanitize the SSID name of a new Wi-Fi access point. A threat actor could create an SSID with a malicious name, including non-standard characters that, when the device attempts connecting to the malicious SSID, the device can be exploited to write arbitrary files or display incorrect information.","status":"published","published":"2022-09-13T15:15:09.257Z","modified":"2026-06-17T04:58:39.927Z","cvss":[{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.7,"vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:27.631109Z"}]}}