# CVE-2019-25717: Dräger Infinity Delta and Kappa Information Disclosure in Log Files

Source: https://junglewise.ai/threats/cve-2019-25717-drager-infinity-delta-and-kappa-information-disclosure-in-log  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2019-25717 · Severity: medium · CVSS 4.3 · Published 2026-06-02

Dräger Infinity Delta and Kappa patient monitors, which are used in clinical settings to track patient vital signs, contain a security flaw that exposes internal system logs. An unauthorized person on the same local network could access these logs to view sensitive technical data, including the device's physical location and network configuration. This information could be used to plan further attacks against the hospital's infrastructure or the medical devices themselves.

Vendors: [Dräger](https://junglewise.ai/threats/vendors/dr-ger).

## Quick answers

**Is CVE-2019-25717 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25717 being exploited in the wild.

**How severe is CVE-2019-25717?** Medium severity, with a CVSS score of 4.3, published 2 June 2026.

**Which products and versions are affected?** Dräger Infinity Delta All software versions; Dräger Infinity Delta XL All software versions; Dräger Infinity Kappa All software versions.

**Is there a fix for CVE-2019-25717?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25717 attacked?** It is attacked from the adjacent network, in a network appliance.

**Am I affected by CVE-2019-25717?** Check whether you run Dräger Infinity Delta, Dräger Infinity Delta XL or Dräger Infinity Kappa at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is classified as CWE-538 (Insertion of Sensitive Information into Externally-Accessible File or Directory). The affected Dräger patient monitors fail to restrict access to system log files over the network, allowing unauthenticated attackers with adjacent network access to retrieve them. These logs contain sensitive metadata including device internals, physical location identifiers, and wired network configuration details. The vulnerability affects all software versions of the Infinity Delta, Delta XL, and Kappa product lines. An attacker can exploit this to gain reconnaissance data for further lateral movement or targeted attacks within the clinical network environment.

## Affected products

- Dräger Infinity Delta All software versions
- Dräger Infinity Delta XL All software versions
- Dräger Infinity Kappa All software versions

## Timeline

- 2026-06-02: advisory: NVD and VulnCheck published advisory details.

## References

- [https://static.draeger.com/security](https://static.draeger.com/security)
- [https://www.vulncheck.com/advisories/dr-ger-infinity-delta-kappa-patient-monitors-unauthenticated-log-file-disclosure](https://www.vulncheck.com/advisories/dr-ger-infinity-delta-kappa-patient-monitors-unauthenticated-log-file-disclosure)

## Related threats

- [Dräger Infinity Patient Monitors denial of service via malformed packet](https://junglewise.ai/threats/cve-2019-25716-drager-infinity-patient-monitors-denial-of-service-via-malformed)