CVE-2022-4992: high-severity vulnerability in Dräger Infinity Acute Care System
Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering
Published · Updated
Follow this CVE+ Monitor Infinity Acute Care System+ Monitor Standalone Infinity M540 patient monitor
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 8.8epss 0.2%
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or alarm limits, or overwhelm the system with excessive network traffic causing the Cockpit or M540 to reboot and lose network functionality.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Affected products
Dräger · Infinity Acute Care SystemDräger · Standalone Infinity M540 patient monitorRelated CVEs — Dräger Infinity Acute Care System
In the same product, most dangerous first.