CVE-2019-25718: Dräger Infinity Explorer C700 kiosk escape privilege escalation

CVE-2019-25718 · Severity: high · CVSS 8.4 · Published 2026-06-01

The Dräger Infinity Explorer C700, a medical workstation used to display patient monitoring data, contains a vulnerability that allows an individual with physical access to bypass its restricted 'kiosk' interface. By interacting with specific system dialogs, an attacker can gain full control over the underlying operating system. This could lead to the manipulation or loss of critical patient data from connected Delta Family monitors, potentially impacting clinical decision-making and patient safety.

Vendors: Dräger.

Quick answers

Is CVE-2019-25718 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2019-25718 being exploited in the wild.
How severe is CVE-2019-25718?
High severity, with a CVSS score of 8.4, published 1 June 2026.
Which products and versions are affected?
Dräger Infinity Explorer C700.
Is there a fix for CVE-2019-25718?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25718 attacked?
It is attacked with local access, in a network appliance.
Am I affected by CVE-2019-25718?
Check whether you run Dräger Infinity Explorer C700. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A privilege escalation vulnerability exists in the Dräger Infinity Explorer C700 due to improper restriction of UI elements (CWE-451). An attacker with local access to the device can exploit specific dialog interactions to escape the restricted kiosk environment and gain unauthorized access to the underlying operating system. Once the kiosk escape is achieved, the attacker can take full control of the OS, potentially leading to the modification or suppression of patient data received from connected Delta Family monitors. The vulnerability is exploited locally without requiring prior authentication or user interaction beyond the attacker's own actions.

Affected products

  • Dräger Infinity Explorer C700

Timeline

  • 2026-06-01: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.