High severity · published Jun 2, 2026
CVE-2019-25722
Dräger SC Monitoring Devices Hard-coded Credentials and DoS
7.6
CVSS
0.2%
EPSS
No
On KEV
Description
Dräger SC Monitoring devices (SC 6002XL, SC 6802XL, SC 7000, SC 8000, SC 9000 XL) contain hard-coded plaintext credentials in source code and a denial-of-service vulnerability that allows local and remote attackers to compromise device integrity across all software versions. A local attacker with direct device access can use the hard-coded credentials to access service and clinical accounts and alter device configuration, while a remote attacker can send malformed network packets to cause repeated device reboots, ultimately resulting in loss of network connectivity and disruption of patient monitoring.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
S6
SC 6002XL · Dräger
SC 6002XL · source: vendor
S7
SC 7000 · Dräger
SC 7000 · source: vendor
SC
SC6802XL · Dräger
SC6802XL · source: vendor
SC
SC8000 · Dräger
SC8000 · source: vendor
SX
SC90000 XL · Dräger
SC90000 XL · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-25722
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-25722
static.draeger.com
https://static.draeger.com/security/download/2019-11-27-Draeger-SC7000-SC9000-security-advisory-update-v1-5.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/dr-ger-sc-monitoring-devices-hard-coded-credentials-and-dos
More from SC 6002XL
6.5
CVE-2019-25720
Dräger SC Monitoring Devices DoS via Malformed Network Packet
