The vulnerability arises from insecure file system permissions within Dräger Protector Software prior to version 6.4.2. Local attackers can replace or modify binaries and loaded modules on the host system, enabling execution of arbitrary code with NT SYSTEM privileges. This escalates local privileges to full system control, allowing attackers to compromise confidentiality, integrity, and availability of the protected environment.

Dräger Protector Software from Dräger, with versions up to but excluding 6.4.2, is affected. Systems running any version prior to 6.4.2 are vulnerable.

The vulnerability carries a CVSS score of 8.3, indicating high severity. EPSS is not available and the vulnerability is not listed in the CISA KEV catalog, but the lack of exploitation data does not diminish the risk to systems that are locally accessible. Attackers need local access and the ability to interact with the protected software; once present, they can replace files controlled by the software, resulting in immediate privilege escalation.