Read the docs
TI-2021-03332 Aliases CVE-2021-4478GHSA-3rp5-97gw-r98q

Dräger CC-Vision Basic and CC-Vision E-Cal Out-of-Bounds Write via Malicious GDT File

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dräger CC-Vision Basic before 7.5.3 and Dräger CC-Vision E-Cal before 7.2.5.0 contain an out-of-bounds write vulnerability when loading .gdt files. A crafted .gdt file can trigger a buffer overflow during file parsing, allowing an attacker to crash the application or execute malicious code on the underlying system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00122 1st percentileScored 2026-11-07
Fix Fixed CC-Vision Basic (Dräger): 7.5.3CC-Vision E-Cal (Dräger): 7.2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrägerCC-Vision Basicbefore 7.5.37.5.3Patch availableCNA
DrägerCC-Vision E-Calbefore 7.2.5.07.2.5.0Patch availableCNA
  • CC-Vision Basic VendorDräger Affected before 7.5.3 Fixed in 7.5.3 Patch available CNA
  • CC-Vision E-Cal VendorDräger Affected before 7.2.5.0 Fixed in 7.2.5.0 Patch available CNA

Remediation

  • Fix · CNA CC-Vision Basic (Dräger) Fixed in 7.5.3
  • Fix · CNA CC-Vision E-Cal (Dräger) Fixed in 7.2.5.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4478
  2. 2026-10-03 Alias added: GHSA-3rp5-97gw-r98q

References

Advisory 1

  • TI-2021-09347 Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote… CVSS 3.1HIGH 8.8
  • TI-2024-13029 Dräger Core 1.0.5 Denial of Service via Malformed SDC Message CVSS 4.0HIGH 8.7
  • TI-2022-04579 Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering CVSS 4.0HIGH 8.8
  • TI-2019-15770 Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling CVSS 4.0HIGH 8.8
  • TI-2021-09348 Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to… CVSS 3.1HIGH 8.8
  • TI-2019-15769 Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass CVSS 4.0HIGH 8.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences