The vulnerability in Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 allows an attacker with network adjacent access to send specially crafted, unencrypted SDC messages during the service discovery process. These malformed packets cause the target process to experience excessive CPU load, ultimately preventing it from processing further SDC messages and leading to a denial of service. The weakness is a classic case of resource exhaustion (CWE-400).

Affected systems include Dräger Core version 1.0.5 and Dräger M540 Converter Service version 1.0.9. No additional vendor product versions are listed in the CNA data.

The CVSS score of 8.7 indicates high severity, but the EPSS score is unavailable, so the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack vector is likely network adjacent, requiring the attacker to be able to send SDC packets to the target machine. The exploitation path is straightforward: send a malformed SDC packet, trigger CPU exhaustion, and disrupt service availability.