CVE-2019-25721: Dräger Infinity M300 DoS Vulnerability

CVE-2019-25721 Overview

CVE-2019-25721 is a network-based denial of service vulnerability affecting Dräger Infinity M300 patient worn monitors running software version VG2.3.1 and earlier. A network-adjacent attacker can send malicious requests over the Infinity Network to repeatedly trigger device reboots. The affected monitor enters a fail state and requires manual restart, causing loss of wireless connectivity and interruption of patient monitoring. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption.

Critical Impact

Repeated exploitation forces clinical patient monitors offline, interrupting telemetry to central stations and requiring on-site manual recovery for each affected device.

Affected Products

• Dräger Infinity M300 patient worn monitor — software version VG2.3.1
• Dräger Infinity M300 patient worn monitor — all earlier VG2.x releases
• Devices connected to the Dräger Infinity Network

Discovery Timeline

• 2026-06-02 - CVE-2019-25721 published to the National Vulnerability Database
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2019-25721

Vulnerability Analysis

The Dräger Infinity M300 is a wearable patient monitor that communicates clinical telemetry over the Infinity Network to central monitoring stations. The vulnerability allows an attacker on the same network segment to deliver crafted network requests that the monitor cannot process safely. Processing the malformed input drives the device into a fault condition and triggers an unscheduled reboot.

Because the device does not throttle or filter the offending traffic, an attacker can repeat the request to keep the monitor in a reboot loop. Each reboot disrupts wireless connectivity, and clinical staff must physically restart the device to restore monitoring.

Root Cause

The root cause is uncontrolled resource consumption in the network request handling path. The firmware fails to validate or rate-limit malformed Infinity Network traffic, allowing untrusted input to consume resources until the device resets. See the Dräger Security Advisory Update for vendor-confirmed technical scope.

Attack Vector

Exploitation requires adjacent network access to the Infinity Network where the M300 monitor is reachable. No authentication or user interaction is required. An attacker with a foothold on a hospital VLAN carrying clinical telemetry can send malicious requests directly to one or more monitors and trigger reboots on demand. Additional analysis is published in the VulnCheck Denial of Service Advisory.

No public exploit code is available, and no verified proof-of-concept has been released. The vulnerability is described in prose by the vendor and VulnCheck advisories; refer to those sources for protocol-level detail.

Detection Methods for CVE-2019-25721

Indicators of Compromise

• Unexpected reboot cycles on Infinity M300 monitors with software version VG2.3.1 or earlier
• Repeated loss of wireless connectivity between M300 devices and the central monitoring station
• Bursts of malformed or unexpected traffic directed at M300 monitor IP addresses on the Infinity Network
• Clinical alerts about gaps in patient telemetry coinciding with device restarts

Detection Strategies

• Baseline normal Infinity Network traffic to M300 monitors and alert on protocol deviations or volumetric spikes
• Correlate device reboot events from biomedical asset management systems with network packet captures from the same time window
• Monitor switch port and wireless controller logs for repeated client disassociation events tied to M300 MAC addresses

Monitoring Recommendations

• Forward biomedical device telemetry, switch logs, and wireless controller logs to a central analytics platform for correlation
• Configure alerting on multiple reboot events from the same monitor within a short interval
• Track unauthorized hosts that initiate sessions to the clinical VLAN hosting Infinity Network traffic

How to Mitigate CVE-2019-25721

Immediate Actions Required

• Inventory all Dräger Infinity M300 monitors and confirm the installed software version
• Restrict the Infinity Network to authorized clinical devices using VLAN segmentation and switch port access control
• Contact Dräger support to obtain and schedule the firmware update that remediates the issue
• Until patched, increase clinical staff awareness so manual restarts and backup monitoring procedures are ready

Patch Information

Dräger has released a software update that addresses the denial of service condition. Operators must coordinate with Dräger service to deploy the updated VG firmware to affected M300 monitors. Refer to the Dräger Security Advisory Update for version guidance and deployment instructions.

Workarounds

• Isolate the Infinity Network from general hospital networks using firewalls and dedicated VLANs
• Deny non-clinical hosts from reaching M300 monitor IP addresses through access control lists
• Disable or physically secure unused network ports in patient care areas to limit adjacent-network access
• Maintain documented manual restart and patient handover procedures in case of monitor failure