Read the docs
TI-2021-03335 Aliases CVE-2021-4481GHSA-766g-x59x-554c

Dräger Protector Software Local Privilege Escalation via Insecure File Permissions

Priority LOW 35CWE-732Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Dräger Protector Software prior to version 6.4.2 contains a local privilege escalation vulnerability due to insecure file system permissions that allows local attackers to execute arbitrary code with elevated privileges. Attackers can replace binaries or loaded modules on the host system to execute code with NT SYSTEM privileges.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00107 1st percentileScored 2026-11-07
Fix Fixed Protector Software (Dräger): 6.4.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrägerProtector Softwarebefore 6.4.26.4.2Patch availableCNA
  • Protector Software VendorDräger Affected before 6.4.2 Fixed in 6.4.2 Patch available CNA

Remediation

  • Fix · CNA Protector Software (Dräger) Fixed in 6.4.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Dräger Protector Software — static.draeger.com/security/download/2021-267-01-Draeger-Pr…

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2021-03334 Dräger Protector Software Local Privilege Escalation via Insecure File PermissionsPriority LOW 35
    Show all 2 records → Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-4481
  2. 2026-10-03 Alias added: GHSA-766g-x59x-554c

References

Advisory 1

  • TI-2021-09347 Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote… CVSS 3.1HIGH 8.8
  • TI-2024-13029 Dräger Core 1.0.5 Denial of Service via Malformed SDC Message CVSS 4.0HIGH 8.7
  • TI-2022-04579 Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering CVSS 4.0HIGH 8.8
  • TI-2019-15770 Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling CVSS 4.0HIGH 8.8
  • TI-2021-09348 Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to… CVSS 3.1HIGH 8.8
  • TI-2019-15769 Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass CVSS 4.0HIGH 8.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences