The vulnerability exposes plaintext credentials embedded in the device source code, enabling an attacker with direct physical or remote network access to authenticate as a service or clinical user and modify device settings. Additionally, malformed network packets trigger repeated reboots, causing loss of connectivity and significant downtime. The resulting compromise of configuration data threatens the integrity of device operation, while the DoS component jeopardizes availability of critical patient monitoring.

Dräger SC Monitoring devices—including model lines SC 6002XL, SC 6802XL, SC 7000, SC 8000, and SC 9000 XL—across all firmware and software versions are affected.

The CVSS v3 score of 7.2 indicates a high‑severity risk. EPSS is not released, and the vulnerability is not listed in the CISA KEV catalog, yet the dual local and remote attack paths present an attractive target for adversaries seeking to subvert device security or disrupt clinical services. Attackers may exploit exposed credentials locally or launch network‑based packet floods to induce reboots; both methods can be carried out without privileged credentials, underscoring the vulnerability’s accessibility.