Sen. Cotton Asks FDA and CISA to Review Older Chinese-Made Networked Devices

Sen. Tom Cotton (R-Ark.) has asked the US Food and Drug Administration and the Cybersecurity and Infrastructure Security Agency (CISA) to review networked medical devices made in China that were cleared before the FDA's enhanced cybersecurity requirements took effect, in a May 26 letter to acting FDA Commissioner Kyle Diamantas.

"I respectfully ask the FDA and CISA to review Chinese-made medical devices cleared prior to March 29, 2023," Cotton wrote, according to the text of the letter published with his office's press release, read via Capitol Releases, an archive of congressional press pages.

Cotton, who chairs the Senate Intelligence Committee, asked the agency to revise its standards by requiring older technology to undergo a cybersecurity clearance similar to that used for new devices, the Washington Examiner reported.

The gap the letter targets

The letter says the FDA began requiring device makers to demonstrate enhanced cybersecurity safeguards for premarket clearance in 2023, but that the requirement did not extend to devices already on the market before then. "Thus, more must be done to protect Americans from compromised medical devices," Cotton wrote.

In the release, his office said compromised Chinese-made devices could give foreign actors access to sensitive personal health data, potentially exposing patients to identity theft, fraud, extortion and misdiagnoses.

The Contec case

Cotton's letter centers on the Contec CMS8000, a networked patient monitor. On January 30, 2025, the FDA issued a safety communication about three cybersecurity vulnerabilities in Contec CMS8000 monitors and Epsimed MN-120 monitors, which it described as relabeled CMS8000 units. The agency said the monitors' software included a backdoor, hidden functionality that could allow unauthorized actors to bypass cybersecurity controls and access or manipulate the device.

The FDA said in that communication that it was not aware of any cybersecurity incidents, injuries or deaths related to the vulnerabilities. In a July 2, 2025, update, it said Contec had released a software patch that removes networking functionality from the affected devices so they can only be used for local monitoring. The agency advised that facility staff obtain the patch from Contec rather than patients or caregivers installing it.

According to the letter, the FDA found the device would automatically extract personally identifiable patient health information when connected to the internet, and CISA warned it was programmed to allow unverified users to control it remotely. The letter says the FDA issued a Class II recall of the Contec CMS8000 on May 14, 2025.

Cotton closed by saying he looked forward to working with Diamantas on the matter. The letter set no deadline for a response.