Read the docs
TI-2022-04579 Aliases CVE-2022-4992GHSA-6jx8-hc3v-28hr

Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering

Priority MEDIUM 43CWE-345Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-345.

Summary

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or alarm limits, or overwhelm the system with excessive network traffic causing the Cockpit or M540 to reboot and lose network functionality.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0016 5th percentileScored 2026-11-07
Fix Fixed Infinity Acute Care System (Dräger): VG4.2, VG4.1.1, VG4.0.3Standalone Infinity M540 patient monitor (Dräger): VG4.2, VG4.1.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
DrägerInfinity Acute Care Systembefore VG4.2; before VG4.1.1; before VG4.0.3VG4.2, VG4.1.1, VG4.0.3Patch availableCNA
DrägerStandalone Infinity M540 patient monitorbefore VG4.2; before VG4.1.1VG4.2, VG4.1.1Patch availableCNA
  • Infinity Acute Care System VendorDräger Affected before VG4.2; before VG4.1.1; before VG4.0.3 Fixed in VG4.2, VG4.1.1, VG4.0.3 Patch available CNA
  • Standalone Infinity M540 patient monitor VendorDräger Affected before VG4.2; before VG4.1.1 Fixed in VG4.2, VG4.1.1 Patch available CNA

Remediation

  • Fix · CNA Infinity Acute Care System (Dräger) Fixed in VG4.2, VG4.1.1, VG4.0.3
  • Fix · CNA Standalone Infinity M540 patient monitor (Dräger) Fixed in VG4.2, VG4.1.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-4992
  2. 2026-10-03 Alias added: GHSA-6jx8-hc3v-28hr

References

Advisory 1

  • TI-2021-09347 Draeger X-Dock Firmware before 03.00.13 has Hard-Coded Credentials, leading to remote… CVSS 3.1HIGH 8.8
  • TI-2024-13029 Dräger Core 1.0.5 Denial of Service via Malformed SDC Message CVSS 4.0HIGH 8.7
  • TI-2019-15770 Dräger Infinity M540 VG4.1.1 Spoofing and DoS via Network Message Handling CVSS 4.0HIGH 8.8
  • TI-2021-09348 Draeger X-Dock Firmware before 03.00.13 has Active Debug Code on a debug port, leading to… CVSS 3.1HIGH 8.8
  • TI-2019-15769 Dräger Infinity Explorer C700 Privilege Escalation via Kiosk Mode Bypass CVSS 4.0HIGH 8.6
  • TI-2025-27661 Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization CVSS 3.1HIGH 7.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences