Denial of Service Vulnerability in Dräger Perseus A500 Software by Dräger

CVE-2019-25723

What is CVE-2019-25723?

The Dräger Perseus A500 software, specifically versions 2.00 through 2.02, is susceptible to an improper input handling vulnerability. This flaw allows external attackers to exploit the Medibus interface by sending specially crafted non-compliant data. Consequently, the internal processor may become overloaded, which can lead to a denial of service condition. This results in a temporary interruption of ventilation as the system may trigger a warm restart, causing critical ventilation pressure to drop to ambient levels before therapy resumes, potentially jeopardizing patient safety.

References