CVE-2019-25717
Last modified
CVE-2019-25717 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated network attackers to access log files over a network connection. Attackers can retrieve device internals, location information, and wired network configuration details from the exposed log files.. EPSS estimates a 0.20% chance of exploitation in the next 30 days.
Description
Dräger Infinity Delta, Delta XL, and Kappa patient monitors contain an information disclosure vulnerability that allows unauthenticated network attackers to access log files over a network connection. Attackers can retrieve device internals, location information, and wired network configuration details from the exposed log files.
Metrics
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Draeger | Infinity Delta Firmware | All versions |
| Draeger | Delta Xl Firmware | All versions |
| Draeger | Kappa Firmware | All versions |
References
- https://static.draeger.com/securityVendor Advisory
- https://www.vulncheck.com/advisories/dr-ger-infinity-delta-kappa-patient-monitors-unauthenticated-log-file-disclosureThird Party Advisory, VDB Entry
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-25717?
How severe is CVE-2019-25717?
How do I fix CVE-2019-25717?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-25710Dolibarr ERP-CRM 8.0.4 contains an SQL injection vulnerabili…9.1
- CVE-2019-25711SpotFTP Password Recover 2.4.2 contains a denial of service …5.5
- CVE-2019-25712BlueAuditor 1.7.2.0 contains a buffer overflow vulnerability…5.5
- CVE-2019-25713MyT-PM 1.5.1 contains an SQL injection vulnerability that al…8.1
- CVE-2019-25714Seeyon OA A8 contains an unauthenticated arbitrary file writ…9.3
- CVE-2019-25716Dräger Infinity Delta, Delta XL, and Kappa patient monitors …7.5
- CVE-2019-25718Dräger Infinity Explorer C700 contains a privilege escalatio…7.8
- CVE-2019-25719Dräger Infinity Acute Care System and Standalone Infinity M5…8.8
- CVE-2019-2572Vulnerability in the Oracle SOA Suite component of Oracle Fu…
- CVE-2019-25720Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000,…7.1
- CVE-2019-25721Dräger Infinity M300 patient worn monitors with software ver…7.1
- CVE-2019-25722Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000,…7.6
Are you affected by CVE-2019-25717?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST