Security and risk assessment of IoMT communication protocols: A data-driven analysis of real-world vulnerabilities

The Internet of Medical Things (IoMT) comprises interconnected medical devices and systems that monitor patients, exchange physiological data, and support clinical decision making through diverse wireless protocols. Although this connectivity improves healthcare efficiency and precision, the coexistence of resource constrained and safety critical devices creates cybersecurity and privacy challenges. This study presents a reproducible comparative vulnerability analysis of Bluetooth Low Energy, Zigbee, Wi-Fi, LoRaWAN, and proprietary radio frequency telemetry. The analysis combines qualitative threat characterization with quantitative assessment of a protocol oriented sample constructed from the National Vulnerability Database JSON 2.0 year feeds labelled 2020 to 2025. Mean CVSS v3.x Exploitability and Impact subscores were normalized against their maxima and combined into a descriptive baseline composite index. Deployment exposure was considered separately through specified noncalibrated scenario multipliers. Analysis of 4378 retained CVEs produced baseline composite indices ranging from R = 0.378 to R = 0.562. Differences in Exploitability distributions did not meet the significance threshold, with p = 0.0561 and a negligible effect size. In contrast, Impact distributions differed statistically, with p < 0.001 and a modest effect size, while Wi-Fi showed the clearest elevated Impact profile. The scenario analysis proportionally rescaled the indices without changing the protocol ordering. As the scenario parameters were not calibrated using operational healthcare data, the resulting values should not be interpreted as measured hospital or home care risk. The findings can inform comparative vulnerability prioritization, mitigation planning, and interpretation of deployment conditions in IoMT systems.