CVE-2019-25722
HighCVSS 7.6Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
Dräger SC monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability, allowing local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use hard-coded credentials to access service and clinical accounts and alter device configuration, while a remote attacker can send malformed network packets to cause repeated device reboots, resulting in loss of network connectivity and disruption of patient monitoring.
Risk Assessment
Risks include unauthorized access to sensitive patient data, device configuration changes, and monitoring interruptions, which can directly endanger patient safety.
Recommendation
Immediately change all default passwords, implement network segmentation, and contact the manufacturer for firmware updates.
Other vulnerabilities in Dräger SC Monitoring Devices
Original NVD description (English source)
Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and alter device configuration, while a remote attacker can send malformed network packets to cause repeated device reboots, ultimately resulting in loss of network connectivity and disruption of patient monitoring.