CVE-2019-25719
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities. These allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions.
Risk Assessment
Attackers can modify alarm settings or overwhelm the system with data, causing device reboot and loss of network functionality, endangering patient safety.
Recommendation
Update the monitor software to the latest version and restrict access to Infinity network ports and wireless access points.
Other vulnerabilities in Dräger Infinity Acute Care System
Original NVD description (English source)
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors running software versions VG4.1.1, VG4.0.3, and lower contain network message handling vulnerabilities that allow network-adjacent attackers to spoof or tamper with data and cause denial-of-service conditions. Attackers with access to an enabled Infinity network port or physical proximity to a wireless access point can modify device settings such as alarm states or alarm limits, and overwhelm the system with incoming data causing the device to reboot and lose network functionality.