TI-2019-15774 Aliases CVE-2019-25723 GHSA-9p7r-jmp9-7hw2

Dräger Perseus A500 2.00-2.02 DoS via Medibus Interface

LOW 28CWE-1286Published 2026-06-02 · Updated 2026-06-03

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dräger Perseus A500 software versions 2.00 through 2.02 contains an improper input handling vulnerability that allows external attackers to cause a denial of service by sending specifically crafted non-Medibus-compliant data through the Medibus interface. Attackers can overload the internal processor with malformed data to trigger a warm restart, causing ventilation pressure to drop to ambient level and interrupting ventilation for several seconds before therapy resumes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00236 14th percentileScored 2026-11-07

Fix Fixed Perseus A500 (Dräger): 2.03

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Dräger	Perseus A500	2.00; 2.01; 2.02	2.03	Patch available	CNA

Perseus A500 VendorDräger Affected 2.00; 2.01; 2.02 Fixed in 2.03 Patch available CNA

Remediation

Fix · CNA Perseus A500 (Dräger) Fixed in 2.03

Timeline

2026-10-02 Threatist record created from CVE-2019-25723
2026-10-03 Alias added: GHSA-9p7r-jmp9-7hw2

References

Advisory 1

https://static.draeger.com/security/download/2020-06-PSA-20-169-01-Security-Advisory-Perseus-A500-SW20n.pdf

TI-2021-09347 Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote… CVSS 3.1HIGH 8.8
TI-2024-13029 Dräger Core 1.0.5 Denial of Service via Malformed SDC Message CVSS 4.0HIGH 8.7
TI-2022-04579 Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering CVSS 4.0HIGH 8.8
TI-2019-15770 Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling CVSS 4.0HIGH 8.8
TI-2021-09348 Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to… CVSS 3.1HIGH 8.8
TI-2019-15769 Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass CVSS 4.0HIGH 8.6

See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences