# CVE-2024-14036: Dräger Core and M540 Converter Service denial of service via SDC messages

Source: https://junglewise.ai/threats/cve-2024-14036-drager-core-and-m540-converter-service-denial-of-service-via-sdc  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2024-14036 · Severity: high · CVSS 7.5 · Published 2026-06-02

Dräger medical networking components are vulnerable to a flaw that allows an attacker on the hospital network to disable the device's communication capabilities. By sending specifically malformed messages, an attacker can overload the system's processor, causing it to stop responding to legitimate medical data requests. This could lead to a loss of real-time monitoring or data conversion services in a clinical environment.

Vendors: [Dräger](https://junglewise.ai/threats/vendors/dr-ger).

## Quick answers

**Is CVE-2024-14036 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-14036 being exploited in the wild.

**How severe is CVE-2024-14036?** High severity, with a CVSS score of 7.5, published 2 June 2026.

**Which products and versions are affected?** Dräger M540 Converter Service <= 1.0.9.

**Is there a fix for CVE-2024-14036?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2024-14036 attacked?** It is attacked over the network or from the adjacent network, in a network appliance.

**Am I affected by CVE-2024-14036?** Check whether you run Dräger M540 Converter Service at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A denial of service vulnerability exists in Dräger Core (<= 1.0.5) and M540 Converter Service (<= 1.0.9) due to uncontrolled resource consumption (CWE-400). The flaw is triggered during the discovery process when the service receives specially crafted, unencrypted Service-Oriented Device Connectivity (SDC) messages. An attacker with network access can transmit these malformed packets to exhaust CPU resources, effectively hanging the affected process and preventing further SDC message handling. The attack does not require authentication or user interaction.

## Affected products

- Dräger Core <= 1.0.5
- Dräger M540 Converter Service <= 1.0.9

## Timeline

- 2026-06-02: disclosed
- 2026-06-02: advisory

## References

- [https://static.draeger.com/security](https://static.draeger.com/security)
- [https://www.vulncheck.com/advisories/dr-ger-core-denial-of-service-via-malformed-sdc-message](https://www.vulncheck.com/advisories/dr-ger-core-denial-of-service-via-malformed-sdc-message)