High severity · published Jun 2, 2026
CVE-2024-14036
Dräger Core 1.0.5 Denial of Service via Malformed SDC Message
7.5
CVSS
0.3%
EPSS
No
On KEV
Description
Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-adjacent attackers to trigger high CPU load by sending specially crafted, unencrypted SDC messages during the discovery process. Attackers with access to the hospital network can send malformed SDC packets to exhaust CPU resources in the affected process, causing further SDC messages to no longer be processed.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
Core · Dräger
through 1.0.5 · source: vendor
MC
M540 Converter Service · Dräger
through 1.0.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-14036
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-14036
static.draeger.com
https://static.draeger.com/security/download/PSA-24-110-1-gSOAP-Product-Security-Advisory.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/dr-ger-core-denial-of-service-via-malformed-sdc-message