CVE-2022-4992

June 3, 2026, 8:16 p.m.

8.8
High

Description

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors versions VG4.1.1, VG4.0.3, and lower (with VG4.2 partially affected) contain a network message handling vulnerability that allows remote attackers to inject spoofed or tampered data and cause denial-of-service conditions. Attackers can compromise network communications to modify device settings such as alarm states or alarm limits, or overwhelm the system with excessive network traffic causing the Cockpit or M540 to reboot and lose network functionality.

Product(s) Impacted

Vendor Product Versions
Drager
  • Infinity Acute Care System
  • Standalone Infinity M540
  • VG4.1.1, VG4.0.3, <VG4.0.3
  • VG4.1.1, VG4.0.3, <VG4.0.3

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-345
Insufficient Verification of Data Authenticity
The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a drager infinity_acute_care_system VG4.1.1 / / / / / / /
a drager infinity_acute_care_system VG4.0.3 / / / / / / /
a drager infinity_acute_care_system <VG4.0.3 / / / / / / /
a drager standalone_infinity_m540 VG4.1.1 / / / / / / /
a drager standalone_infinity_m540 VG4.0.3 / / / / / / /
a drager standalone_infinity_m540 <VG4.0.3 / / / / / / /

References

https://static.draeger.com/security/download/PSA-19-255-03_Product-Security-Advisory-IACS.pdf
https://www.vulncheck.com/advisories/dr-ger-infinity-m540-vg4-spoofed-network-message-handling-dos-tampering

Tags

CWE-345
[email protected]
2026-06-02
CVE-2022-4992

CVSS Score

8.8 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: LOW
  • Integrity Impact: LOW
  • Availability Impact: HIGH
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: June 2, 2026, 10:16 p.m.
Last Modified: June 3, 2026, 8:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.