CVE-2019-25720

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2019-25720", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-06-02T14:22:01.500Z", "datePublished": "2026-06-03T16:56:29.683Z", "dateUpdated": "2026-06-03T17:44:47.456Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-06-03T16:56:29.683Z"}, "title": "Dr\u00e4ger SC Monitoring Devices DoS via Malformed Network Packet", "datePublic": "2019-11-21T00:00:00.000Z", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-1286", "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input", "type": "CWE"}]}], "affected": [{"vendor": "Dr\u00e4ger", "product": "SC 6002XL", "versions": [{"status": "affected", "version": "SC 6002XL", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC6802XL", "versions": [{"status": "affected", "version": "SC6802XL", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC 7000", "versions": [{"status": "affected", "version": "SC 7000", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC8000", "versions": [{"status": "affected", "version": "SC8000", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC90000 XL", "versions": [{"status": "affected", "version": "SC90000 XL", "versionType": "custom"}], "defaultStatus": "unknown"}], "descriptions": [{"lang": "en", "value": "Dr\u00e4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Dr\u00e4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.</p>"}]}], "references": [{"url": "https://static.draeger.com/security/download/2019-11-27-Draeger-SC7000-SC9000-security-advisory-update-v1-5.pdf", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/dr-ger-sc-monitoring-devices-dos-via-malformed-network-packet", "tags": ["third-party-advisory"]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "ADJACENT", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseSeverity": "MEDIUM", "baseScore": 6.5, "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}}], "credits": [{"lang": "en", "value": "Jeroen Slobbe and Max Grim", "type": "finder"}], "source": {"discovery": "EXTERNAL"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-03T17:44:08.218138Z", "id": "CVE-2019-25720", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T17:44:47.456Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2019-25720", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-03T17:44:08.218138Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-03T17:44:28.963Z"}}], "cna": {"title": "Dr\u00e4ger SC Monitoring Devices DoS via Malformed Network Packet", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Jeroen Slobbe and Max Grim"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Dr\u00e4ger", "product": "SC 6002XL", "versions": [{"status": "affected", "version": "SC 6002XL", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC6802XL", "versions": [{"status": "affected", "version": "SC6802XL", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC 7000", "versions": [{"status": "affected", "version": "SC 7000", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC8000", "versions": [{"status": "affected", "version": "SC8000", "versionType": "custom"}], "defaultStatus": "unknown"}, {"vendor": "Dr\u00e4ger", "product": "SC90000 XL", "versions": [{"status": "affected", "version": "SC90000 XL", "versionType": "custom"}], "defaultStatus": "unknown"}], "datePublic": "2019-11-21T00:00:00.000Z", "references": [{"url": "https://static.draeger.com/security/download/2019-11-27-Draeger-SC7000-SC9000-security-advisory-update-v1-5.pdf", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/dr-ger-sc-monitoring-devices-dos-via-malformed-network-packet", "tags": ["third-party-advisory"]}], "descriptions": [{"lang": "en", "value": "Dr\u00e4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.", "supportingMedia": [{"type": "text/html", "value": "<p>Dr\u00e4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1286", "description": "CWE-1286 Improper Validation of Syntactic Correctness of Input"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-06-03T16:56:29.683Z"}}}, "cveMetadata": {"cveId": "CVE-2019-25720", "state": "PUBLISHED", "dateUpdated": "2026-06-03T17:44:47.456Z", "dateReserved": "2026-06-02T14:22:01.500Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-06-03T16:56:29.683Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unknown", "product": "SC 6002XL", "vendor": "Dr\u00e4ger", "versions": [{"status": "affected", "version": "SC 6002XL", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SC6802XL", "vendor": "Dr\u00e4ger", "versions": [{"status": "affected", "version": "SC6802XL", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SC 7000", "vendor": "Dr\u00e4ger", "versions": [{"status": "affected", "version": "SC 7000", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SC8000", "vendor": "Dr\u00e4ger", "versions": [{"status": "affected", "version": "SC8000", "versionType": "custom"}]}, {"defaultStatus": "unknown", "product": "SC90000 XL", "vendor": "Dr\u00e4ger", "versions": [{"status": "affected", "version": "SC90000 XL", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Dr\u00e4ger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain a denial-of-service vulnerability in all software versions that allows unauthenticated attackers to reboot the monitor by sending a malformed network packet. Attackers can repeatedly send such malformed packets to disrupt patient monitoring until the device falls back to default configuration and loses network connectivity."}, {"lang": "es", "value": "Los dispositivos de monitorizaci\u00f3n Dr\u00e4ger SC (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contienen una vulnerabilidad de denegaci\u00f3n de servicio en todas las versiones de software que permite a atacantes no autenticados reiniciar el monitor enviando un paquete de red malformado. Los atacantes pueden enviar repetidamente dichos paquetes malformados para interrumpir la monitorizaci\u00f3n del paciente hasta que el dispositivo vuelve a la configuraci\u00f3n predeterminada y pierde la conectividad de red."}], "id": "CVE-2019-25720", "lastModified": "2026-07-22T19:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "ADJACENT", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2019-25720", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-03T17:44:08.218138Z", "version": "2.0.3"}}]}, "published": "2026-06-03T18:16:15.910", "references": [{"source": "disclosure@vulncheck.com", "url": "https://static.draeger.com/security/download/2019-11-27-Draeger-SC7000-SC9000-security-advisory-update-v1-5.pdf"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/dr-ger-sc-monitoring-devices-dos-via-malformed-network-packet"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1286"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SC6802XL"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "SC6802XL", "source": "cna", "vendor": "Dr\u00e4ger"}, "product": "sc6802xl", "vendor": "draeger"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SC8000"}}], "enrichment": {"confidence": 89.0, "confidence_source": "matching", "scores": [{"score": 89.0, "source": "matching"}]}, "original": {"product": "SC8000", "source": "cna", "vendor": "Dr\u00e4ger"}, "product": "sc8000", "vendor": "draeger"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SC90000 XL"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "SC90000 XL", "source": "cna", "vendor": "Dr\u00e4ger"}, "product": "sc90000_xl", "vendor": "draeger"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SC 6002XL"}}], "enrichment": {"confidence": 91.0, "confidence_source": "matching", "scores": [{"score": 91.0, "source": "matching"}]}, "original": {"product": "SC 6002XL", "source": "cna", "vendor": "Dr\u00e4ger"}, "product": "sc_6002xl", "vendor": "draeger"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "SC 7000"}}], "enrichment": {"confidence": 90.0, "confidence_source": "matching", "scores": [{"score": 90.0, "source": "matching"}]}, "original": {"product": "SC 7000", "source": "cna", "vendor": "Dr\u00e4ger"}, "product": "sc_7000", "vendor": "draeger"}], "created": "2026-06-03T18:30:36.285035+00:00", "updated": "2026-06-05T08:30:24.083051+00:00", "vendors": ["draeger", "draeger$PRODUCT$sc6802xl", "draeger$PRODUCT$sc8000", "draeger$PRODUCT$sc90000_xl", "draeger$PRODUCT$sc_6002xl", "draeger$PRODUCT$sc_7000"]}