# CVE-2022-4992: Dräger Infinity Patient Monitors Insufficient Data Verification

Source: https://junglewise.ai/threats/cve-2022-4992-drager-infinity-patient-monitors-insufficient-data-verification  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2022-4992 · Severity: high · CVSS 8.6 · Published 2026-06-02

Dräger patient monitoring systems used in hospitals contain a flaw in how they process network messages. An attacker could remotely interfere with these devices to change critical settings like alarm limits or force the monitors to reboot. This could lead to a loss of patient monitoring capabilities or the failure of medical staff to be alerted to life-threatening patient conditions.

Vendors: [Dräger](https://junglewise.ai/threats/vendors/dr-ger).

## Quick answers

**Is CVE-2022-4992 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2022-4992 being exploited in the wild.

**How severe is CVE-2022-4992?** High severity, with a CVSS score of 8.6, published 2 June 2026.

**Which products and versions are affected?** Dräger Infinity Acute Care System VG4.1.1, VG4.0.3, and lower; VG4.2 partially affected; Dräger Infinity M540 VG4.1.1, VG4.0.3, and lower; VG4.2 partially affected.

**Is there a fix for CVE-2022-4992?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2022-4992 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2022-4992?** Check whether you run Dräger Infinity Acute Care System or Dräger Infinity M540 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is classified as CWE-345 (Insufficient Verification of Data Authenticity) within the network message handling component of the Dräger Infinity systems. A remote, unauthenticated attacker can send specially crafted network traffic to the device to inject spoofed or tampered data. This can be used to modify device configurations, such as alarm states and limits, or to launch a denial-of-service attack by overwhelming the system with traffic. Successful exploitation can cause the M540 monitor or the Cockpit interface to reboot, resulting in a total loss of network functionality and monitoring during the restart period.

## Affected products

- Dräger Infinity Acute Care System VG4.1.1, VG4.0.3, and lower; VG4.2 partially affected
- Dräger Standalone Infinity M540 patient monitor VG4.1.1, VG4.0.3, and lower; VG4.2 partially affected

## Timeline

- 2026-06-02: disclosed
- 2026-06-02: advisory

## References

- [https://static.draeger.com/security](https://static.draeger.com/security)
- [https://www.vulncheck.com/advisories/dr-ger-infinity-m540-vg4-spoofed-network-message-handling-dos-tampering](https://www.vulncheck.com/advisories/dr-ger-infinity-m540-vg4-spoofed-network-message-handling-dos-tampering)

## Related threats

- [Dräger Infinity Patient Monitors message handling spoofing and DoS](https://junglewise.ai/threats/cve-2019-25719-drager-infinity-patient-monitors-message-handling-spoofing-and)