CVE-2019-25722 PUBLISHED

Dräger SC Monitoring Devices Hard-coded Credentials and DoS

Assigner: VulnCheck
Reserved: 02.06.2026 Published: 02.06.2026 Updated: 03.06.2026

Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and alter device configuration, while a remote attacker can send malformed network packets to cause repeated device reboots, ultimately resulting in loss of network connectivity and disruption of patient monitoring.

Metrics

CVSS Vector: CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CVSS Score: 7.2

Product Status

Vendor Dräger
Product SC 6002XL
Versions Default: unknown
  • affected from all versions to VG2.3.1 (incl.)
Vendor Dräger
Product SC6802XL
Versions Default: unknown
  • Version all versions is affected
Vendor Dräger
Product SC 7000
Versions Default: unknown
  • Version all versions is affected
Vendor Dräger
Product SC8000
Versions Default: unknown
  • Version all versions is affected
Vendor Dräger
Product SC90000 XL
Versions Default: unknown
  • Version all versions is affected

Credits

  • Jeroen Slobbe and Max Grim finder

References

Problem Types

  • CWE-798 Use of Hard-coded Credentials CWE