Network-Based Denial of Service Vulnerability in Dräger Infinity M300 Patient Monitors

CVE-2019-25724

What is CVE-2019-25724?

Dräger's Infinity M300 patient monitors, running software version VG2.x and earlier, are susceptible to a network-based denial of service vulnerability. Attackers with access to the hospital or Infinity Network can exploit this flaw to trigger repeated device reboots. This exploitation results in the monitor entering a fail state, which requires manual intervention to restart. If compromised, this vulnerability can lead to significant disruptions, including loss of wireless connectivity, temporary lapses in patient monitoring, and interruptions in alarm functionalities, posing a serious risk to patient safety.

References