CVE-2019-25722
HIGH EPSS 9.2%
Published Jun 2, 20261mo ago · Modified Jun 17, 20262w ago
7.2 CVSS 4.0
Published Jun 2, 2026 1mo ago
Last Modified Jun 17, 2026 2w ago
Description
Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and alter device configuration, while a remote attacker can send malformed network packets to cause repeated device reboots, ultimately resulting in loss of network connectivity and disruption of patient monitoring.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Attack Vector Adjacent
Attack Complexity Low
Privileges Required None
User Interaction None
Scope X
Threat Intelligence
EPSS Exploit Probability
9.2% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available
Weaknesses 1
CWE-798 Use of Hard-coded Credentials Authentication
References 2
- static.draeger.com https://static.draeger.com/security/download/2019-11-27-Draeger-SC7000-SC9000-security-advisory-update-v1-5.pdf
- vulncheck.com https://www.vulncheck.com/advisories/dr-ger-sc-monitoring-devices-hard-coded-credentials-and-dos
Remediation
No remediation data recorded yet
Check vendor advisories and the NVD entry for patch availability.