# CVE-2019-25723: Dräger Perseus A500 improper input handling in Medibus interface

Source: https://junglewise.ai/threats/cve-2019-25723-drager-perseus-a500-improper-input-handling-in-medibus-interface  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2019-25723 · Severity: medium · CVSS 4 · Published 2026-06-02

The Dräger Perseus A500 is an anesthesia workstation used to provide ventilation and anesthesia to patients during medical procedures. A vulnerability in its communication interface allows an attacker to send malformed data that crashes the device's internal processor. This causes a temporary loss of ventilation pressure and interrupts patient therapy for several seconds while the system restarts, potentially impacting patient safety.

Vendors: [Dräger](https://junglewise.ai/threats/vendors/dr-ger).

## Quick answers

**Is CVE-2019-25723 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25723 being exploited in the wild.

**How severe is CVE-2019-25723?** Medium severity, with a CVSS score of 4, published 2 June 2026.

**Which products and versions are affected?** Dräger Perseus A500 2.00 through 2.02.

**Is there a fix for CVE-2019-25723?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25723 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2019-25723?** Check whether you run Dräger Perseus A500 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An improper input handling vulnerability (CWE-1286) exists in the Medibus interface of Dräger Perseus A500 anesthesia workstations running software versions 2.00 to 2.02. An unauthenticated attacker with network access to the Medibus interface can transmit specially crafted, non-compliant data packets to the device. This malformed input overloads the internal processor, triggering a warm restart of the system. During this restart period, ventilation pressure drops to ambient levels, resulting in a temporary cessation of therapy for several seconds until the system automatically resumes operation. The attack requires the ability to reach the Medibus interface, which is typically used for medical device data integration.

## Affected products

- Dräger Perseus A500 2.00 through 2.02

## Timeline

- 2026-06-02: advisory: Vulnerability published by VulnCheck and NVD.

## References

- [https://static.draeger.com/security](https://static.draeger.com/security)
- [https://www.vulncheck.com/advisories/dr-ger-perseus-a500-dos-via-medibus-interface](https://www.vulncheck.com/advisories/dr-ger-perseus-a500-dos-via-medibus-interface)