CVE-2022-4992Dräger Infinity M540 VG4.1.1 Spoofed Network Message Handling DoS/Tampering
Updated under an hour ago ()
Does this affect you?
It affects Dräger Infinity Acute Care System and 1 other product. Add what you run to find out whether that includes you.
EPSS puts the chance of exploitation in the next 30 days at 0.16%, higher than 5% of scored CVEs.
Do this next
Free account, 1 product
Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or alarm limits, or overwhelm the system with excessive network traffic causing the Cockpit or M540 to reboot and lose network functionality.
- CVSS
- 8.6 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
- Weakness (CWE)
- CWE-345
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- 0.16% (percentile 5)
- Assigned by
- VulnCheck
- NVD analysis
- Awaiting Analysis
- Record last updated
- Jun 5, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Dräger Infinity Acute Care System drager:infinity_acute_care_system (from the name) | before VG4.2; before VG4.1.1; before VG4.0.3 | CNA record |
Dräger Standalone Infinity M540 patient monitor drager:standalone_infinity_m540_patient_monitor (from the name) | before VG4.2; before VG4.1.1 | CNA record |
References
- https://static.draeger.com/security/download/PSA-19-255-03_Product-Security-Advisory-IACS.pdfvendor-advisory
- https://www.vulncheck.com/advisories/dr-ger-infinity-m540-vg4-spoofed-network-message-handling-dos-tamperingthird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.