Dräger Infinity systems that run software versions VG4.1.1, VG4.0.3, and earlier contain a network message handling flaw identified by CWE‑924. The flaw allows an attacker with proximity to an enabled Infinity network port or a nearby wireless access point to inject or alter control messages. By modifying these messages an attacker can tamper with device settings, such as alarm states or limits, and send excessive traffic that forces the monitor to reboot, thereby disrupting communication and effectively causing a denial‑of‑service condition.

The vulnerability affects Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors. Affected firmware releases are VG4.1.1, VG4.0.3, and all earlier versions.

The CVSS score of 8.8 classifies this as high severity. Although no EPSS value is available and the issue is not listed in the CISA KEV catalog, the inherent need for network or wireless proximity suggests that local or sub‑network attackers could exploit it. The lack of authentication or input validation in the message handling path makes the vulnerability readily reproducible, heightening the overall risk for devices in shared or untrusted networks.