CVE-2019-25724: Dräger Infinity M300 DoS Vulnerability

CVE-2019-25724 Overview

CVE-2019-25724 is a network-based denial of service vulnerability affecting Dräger Infinity M300 patient worn monitors running software version VG2.x and earlier. An attacker with access to the hospital network or the Infinity Network can repeatedly trigger device reboots until the monitor enters a fail state. Recovery requires manual restart by clinical or biomedical staff. The flaw is tracked under CWE-400: Uncontrolled Resource Consumption and carries a CVSS v4.0 base score of 7.1.

Critical Impact

Successful exploitation causes loss of wireless connectivity, interruption of continuous patient monitoring, and disruption of alarm functionality, directly impacting patient safety in clinical environments.

Affected Products

• Dräger Infinity M300 patient worn monitor — software version VG2.x
• Dräger Infinity M300 patient worn monitor — software versions earlier than VG2.x
• Devices connected to the Dräger Infinity Network

Discovery Timeline

• 2026-06-02 - CVE-2019-25724 published to NVD
• 2026-06-03 - Last updated in NVD database

Technical Details for CVE-2019-25724

Vulnerability Analysis

The Dräger Infinity M300 is a wearable patient monitor used in hospitals to track vitals and transmit telemetry over wireless networks. The device fails to adequately handle a class of network traffic originating from the adjacent network. An attacker who reaches the Infinity Network or the broader hospital LAN can transmit traffic that forces the monitor into a reboot loop. After repeated reboots, the device transitions into a fail state where automatic recovery does not occur.

While the device is rebooting or in a fail state, it cannot transmit patient vitals, sustain wireless connectivity, or deliver clinical alarms to central monitoring stations. The vulnerability does not compromise confidentiality or integrity of patient data, but the availability impact is severe in a clinical setting.

Root Cause

The vulnerability stems from uncontrolled resource consumption [CWE-400] in the M300 firmware. The device does not impose appropriate rate limiting or input validation on incoming network traffic, allowing repeated reboot conditions to be triggered. Once the watchdog or recovery logic exhausts its retry budget, the monitor halts in a fail state requiring physical intervention.

Attack Vector

Exploitation requires adjacent network access. An attacker must already be present on the hospital network or the dedicated Infinity Network used by Dräger patient monitoring infrastructure. No authentication or user interaction is required. The attacker sends crafted or sustained network traffic toward the M300 monitor, repeatedly causing it to reboot until it enters the unrecoverable fail state.

No verified public proof-of-concept code is available for this vulnerability. Refer to the Dräger Security Advisory M300-VG2x and the VulnCheck Advisory for M300-VG2x DDoS for the vendor and analyst descriptions of the issue.

Detection Methods for CVE-2019-25724

Indicators of Compromise

• Repeated, unexplained reboots of Infinity M300 patient worn monitors
• M300 devices entering a fail state requiring manual restart by biomedical staff
• Temporary loss of patient telemetry or alarms at central monitoring stations
• Loss of wireless connectivity from M300 endpoints on the Infinity Network

Detection Strategies

• Monitor wireless access point and switch logs for repeated association and disassociation events tied to M300 device MAC addresses.
• Correlate central monitoring station gaps in patient telemetry with network events on the Infinity VLAN.
• Inspect network flows on the Infinity Network for unusual broadcast, multicast, or high-volume unicast traffic directed at monitor IP addresses.

Monitoring Recommendations

• Deploy network intrusion detection on the Infinity Network segment with rules tuned for anomalous traffic patterns against medical device IP ranges.
• Track device uptime and reboot counters for each M300 monitor and alert on thresholds that exceed normal operational baselines.
• Enable SNMP or syslog forwarding from wireless infrastructure supporting the Infinity Network to a SIEM for centralized review.

How to Mitigate CVE-2019-25724

Immediate Actions Required

• Contact Dräger technical support to confirm M300 software version and obtain available remediation guidance for VG2.x deployments.
• Segment the Infinity Network from general hospital traffic using VLANs and firewall rules that restrict reachability to authorized monitoring infrastructure only.
• Restrict wireless network access to authenticated clinical devices and disable open or guest SSIDs that overlap with the Infinity Network.
• Establish a manual recovery procedure with biomedical engineering to quickly restore monitors that enter the fail state.

Patch Information

Refer to the Dräger Security Advisory M300-VG2x for vendor-supplied remediation guidance and supported software upgrade paths. Customers should coordinate directly with Dräger service representatives to validate the appropriate update or replacement plan for affected M300 monitors.

Workarounds

• Isolate the Infinity Network behind dedicated firewalls and access control lists that permit only required monitoring traffic.
• Apply 802.1X or WPA2-Enterprise authentication on the wireless network supporting M300 devices to prevent unauthorized adjacent access.
• Implement rate limiting and broadcast storm controls on switches serving the Infinity Network segment.
• Maintain redundant clinical monitoring procedures so that device fail states do not leave patients without observation.

# Example network segmentation policy (vendor-neutral)
# Restrict the Infinity VLAN to authorized monitoring hosts only
interface vlan 50
 description Infinity-Network-Patient-Monitoring
 ip access-group INFINITY-ACL in
!
ip access-list extended INFINITY-ACL
 permit ip 10.50.0.0 0.0.255.255 host 10.50.1.10   # Central monitoring station
 permit ip 10.50.0.0 0.0.255.255 host 10.50.1.11   # Backup monitoring station
 deny   ip any any log