Patient-data disclosure via hard-coded telemetry destination

Information exposure in all versions of Contec CMS8000 Patient Monitor firmware allows attackers to read patient data sent to a public IP address. At startup, the default firmware connects to a hard-coded address and streams unencrypted patient and sensor data over TCP port 515, an LPD-designated port. A patient must be connected and the monitor must have network connectivity; the recipient at that address or man-in-the-middle attackers can read the data.