Read the docs
TI-2019-15771 Aliases CVE-2019-25720GHSA-4wcc-pjv3-vvw7

Dräger SC Monitoring Devices DoS via Malformed Network Packet

Priority LOW 31CWE-1286Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00199 9th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrägerSC 6002XLSC 6002XL—No fix listedCNA
DrägerSC6802XLSC6802XL—No fix listedCNA
DrägerSC 7000SC 7000—No fix listedCNA
DrägerSC8000SC8000—No fix listedCNA
DrägerSC90000 XLSC90000 XL—No fix listedCNA
  • SC 6002XL VendorDräger Affected SC 6002XL Fixed in — No fix listed CNA
  • SC6802XL VendorDräger Affected SC6802XL Fixed in — No fix listed CNA
  • SC 7000 VendorDräger Affected SC 7000 Fixed in — No fix listed CNA
  • SC8000 VendorDräger Affected SC8000 Fixed in — No fix listed CNA
  • SC90000 XL VendorDräger Affected SC90000 XL Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Dräger SC 6002XL, SC 7000 and 3 more products — static.draeger.com/security/download/2019-11-27-Draeger-SC7…

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2019-15773 Dräger SC Monitoring Devices Hard-coded Credentials and DoSPriority LOW 31
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-25720
  2. 2026-10-03 Alias added: GHSA-4wcc-pjv3-vvw7

References

Advisory 1

  • TI-2021-09347 Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote… CVSS 3.1HIGH 8.8
  • TI-2024-13029 Dräger Core 1.0.5 Denial of Service via Malformed SDC Message CVSS 4.0HIGH 8.7
  • TI-2022-04579 Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering CVSS 4.0HIGH 8.8
  • TI-2019-15770 Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling CVSS 4.0HIGH 8.8
  • TI-2021-09348 Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to… CVSS 3.1HIGH 8.8
  • TI-2019-15769 Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass CVSS 4.0HIGH 8.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences