Medical Device & IoMT Security Dashboard

53%

Networked Devices w/ a Known Critical Vuln

▲ FBI Cyber Division estimate

1 in 5

Devices on Unsupported / Legacy OS

▲ ~20% run end-of-life software

75%

Infusion Pumps w/ Security Weaknesses

▲ Analysis of 200,000+ pumps

13%

Devices That Support Endpoint Protection

▼ The core defensive gap

▸Known Vulnerabilities by Device Category

So what: Infusion/IV pumps are the single largest attack surface in a hospital — the most numerous connected device and the most vulnerable, with ~75% carrying identifiable cybersecurity weaknesses. They are the highest-leverage place to start network segmentation and patch governance.

▸FDA Device Recalls by Risk Class (FY2020–2024)

So what: Of 3,934 FDA device recalls in FY2020–2024, ~88% were Class II and ~9% Class I (highest risk). Class I recalls rose from 7.7% of events in 2023 to 10.8% in 2024 — a signal that the most dangerous device defects, increasingly including software/cyber faults, are trending up.

▸IoMT Risk Scorecard by Device Class

Infusion / IV pumps

Patient monitors

Imaging / PACS (DICOM)

Legacy Windows hosts

Pneumatic tube systems

Patient portals / wearables

Scoring: composite of vulnerability prevalence, exploitability, network exposure, and patient-safety impact. Highest scores combine high vulnerability rates with direct patient contact — where a compromise can affect care, not just data.

▸Recent CISA ICS Medical Advisories (ICSMA)

Device	Advisory	Issue	Severity
Contec CMS8000 Patient Monitor	ICSMA-25-030-01	Hard-coded backdoor / data exfiltration	Critical
Philips Vue PACS	ICSMA-24-200-01	Remote code execution, info disclosure	High
Baxter Connex Health Portal	ICSMA-24-249-01	Improper access control	High
OHIF DICOM Viewers	ICSMA-26-176-02	Cross-site scripting / data exposure	Medium
pydicom / pynetdicom Library	ICSMA-26-176-01	Path traversal in imaging library	Medium
Fourth Frontier Frontier X	ICSMA-26-148-01	Cleartext transmission / auth weakness	Medium

So what: The Contec CMS8000 advisory is the textbook case — a patient monitor shipping with a hidden function that sent data to a hard-coded external IP. Inventory and continuous monitoring (NIST CSF Identify + Detect) are the only way these are caught before they reach a bedside.

▸NIST CSF 2.0 Controls Mapped to IoMT Risk

Identify

Complete IoMT asset inventory & software bill of materials (SBOM)

Counters: unknown legacy/EOL devices, shadow IoMT

Protect

Network segmentation / VLANs, least-privilege access, patch & firmware governance

Counters: flat networks, unpatched pumps & monitors

Detect

Passive network monitoring & anomaly detection for device traffic

Counters: backdoors, exfiltration (e.g., CMS8000)

Respond

Device-specific incident playbooks; clinical-engineering escalation

Counters: slow containment, patient-safety impact

Recover

Validated device re-imaging & safe fail-over to manual care

Counters: care disruption during incidents

Govern

Procurement security requirements & FDA premarket cyber alignment

Counters: insecure-by-design devices entering the fleet