Is CVE-2019-25719 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-25719 being exploited in the wild.

How severe is CVE-2019-25719?

High severity, with a CVSS score of 8.6, published 2 June 2026.

Which products and versions are affected?

Dräger Infinity Acute Care System VG4.1.1, VG4.0.3, and lower; Dräger Infinity M540 VG4.1.1, VG4.0.3, and lower.

Is there a fix for CVE-2019-25719?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2019-25719 attacked?

It is attacked over the network or from the adjacent network, in a network appliance.

Am I affected by CVE-2019-25719?

Check whether you run Dräger Infinity Acute Care System or Dräger Infinity M540 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-25719: Dräger Infinity Patient Monitors message handling spoofing and DoS

CVE-2019-25719 · Severity: high · CVSS 8.6 · Published 2026-06-02

Dräger Infinity patient monitors, used in hospitals to track vital signs, are vulnerable to network-based attacks. An attacker with access to the hospital network or wireless access points can remotely change critical device settings like alarm limits or crash the device entirely. This could lead to missed medical emergencies or a total loss of patient monitoring capabilities during clinical operations.

Vendors: Dräger.

Quick answers

Is CVE-2019-25719 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-25719 being exploited in the wild.
How severe is CVE-2019-25719?: High severity, with a CVSS score of 8.6, published 2 June 2026.
Which products and versions are affected?: Dräger Infinity Acute Care System VG4.1.1, VG4.0.3, and lower; Dräger Infinity M540 VG4.1.1, VG4.0.3, and lower.
Is there a fix for CVE-2019-25719?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2019-25719 attacked?: It is attacked over the network or from the adjacent network, in a network appliance.
Am I affected by CVE-2019-25719?: Check whether you run Dräger Infinity Acute Care System or Dräger Infinity M540 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is classified as an improper enforcement of message integrity (CWE-924) within the network message handling component of the Dräger Infinity software. Attackers with network adjacency—either through a physical Infinity network port or proximity to a wireless access point—can send malicious traffic to the device without authentication. This allows for the unauthorized modification of device settings, such as alarm states and limits, or the injection of excessive data to trigger a system reboot. Successful exploitation results in a denial-of-service (DoS) and loss of network monitoring functionality. Affected versions include VG4.1.1, VG4.0.3, and earlier.

Affected products

Dräger Infinity Acute Care System VG4.1.1, VG4.0.3, and lower
Dräger Standalone Infinity M540 patient monitor VG4.1.1, VG4.0.3, and lower

Timeline

2026-06-02: advisory: NVD and VulnCheck published advisory details.

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.