Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitors are vulnerable to a spoofed network message handling flaw that lets remote attackers inject forged or altered data. This can lead to denial‑of‑service by exhausting resources, force device reboots, and cause the Cockpit or M540 to lose network functionality. Additionally, attackers may modify critical settings such as alarm states or alarm limits, impacting patient safety and operational integrity.

Dräger Infinity Acute Care System and Standalone Infinity M540 patient monitor models running firmware versions VG4.1.1, VG4.0.3, and lower, with partial impact on VG4.2.

The vulnerability scores a CVSS of 8.8, indicating high severity. EPSS data is unavailable, so the exploitation probability is unknown, and it is not listed in the CISA KEV catalog. The attack vector is remote, relying on an attacker’s ability to send spoofed network packets to the device, which is feasible over any network segment that can reach the monitor.