# CVE-2019-25724: Dräger Infinity M300 denial of service via network-based reboots

Source: https://junglewise.ai/threats/cve-2019-25724-drager-infinity-m300-denial-of-service-via-network-based-reboots  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2019-25724 · Severity: medium · CVSS 6.5 · Published 2026-06-02

Dräger Infinity M300 patient monitors, which are wearable devices used to track patient vital signs in hospitals, are vulnerable to a network-based attack. An attacker on the hospital network can remotely force these devices to reboot repeatedly until they stop functioning entirely. This results in a loss of patient monitoring and medical alarms, requiring staff to manually intervene and restart each affected device.

Vendors: [Dräger](https://junglewise.ai/threats/vendors/dr-ger).

## Quick answers

**Is CVE-2019-25724 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2019-25724 being exploited in the wild.

**How severe is CVE-2019-25724?** Medium severity, with a CVSS score of 6.5, published 2 June 2026.

**Which products and versions are affected?** Dräger Infinity M300 VG2.x and earlier.

**Is there a fix for CVE-2019-25724?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2019-25724 attacked?** It is attacked from the adjacent network.

**Am I affected by CVE-2019-25724?** Check whether you run Dräger Infinity M300 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in Dräger Infinity M300 patient monitors (versions VG2.x and earlier) due to uncontrolled resource consumption (CWE-400). An attacker with access to the hospital or Infinity Network can send malicious network traffic to trigger a device reboot. By repeatedly exploiting this, the attacker can force the device into a fail state that requires a manual hardware restart. This results in the loss of wireless connectivity, patient monitoring data, and alarm functionality. The attack requires adjacent network access but no authentication or user interaction.

## Affected products

- Dräger Infinity M300 VG2.x and earlier

## Timeline

- 2026-06-02: advisory: Advisory published by VulnCheck and NVD

## References

- [https://static.draeger.com/security](https://static.draeger.com/security)
- [https://www.vulncheck.com/advisories/dr-ger-infinity-m300-vg2-x-network-based-denial-of-service](https://www.vulncheck.com/advisories/dr-ger-infinity-m300-vg2-x-network-based-denial-of-service)

## Related threats

- [Dräger Infinity M300 denial of service in patient worn monitors](https://junglewise.ai/threats/cve-2019-25721-drager-infinity-m300-denial-of-service-in-patient-worn-monitors)