CVE-2019-25718: Draeger Infinity Explorer C700 Firmware privilege escalation (CVSS 8.4)

Description

Dräger Infinity Explorer C700 contains a privilege escalation vulnerability that allows attackers to break out of kiosk mode and access the underlying operating system through a specific dialog interaction. Attackers can exploit this kiosk escape to take control of the operating system and cause the device to display incorrect or no information from the connected Delta Family patient monitor.

CVSS 3.1 breakdown

Attack vectorLocal

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeUnchanged

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Draeger Infinity Explorer C700 Firmwareall versions

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

Patch & vendor advisories

https://static.draeger.com/security/download/2019-01-22-draeger-infinity-delta-vf10-1-security-advisory.pdf

References

https://static.draeger.com/security/download/2019-01-22-draeger-infinity-delta-vf10-1-security-advisory.pdfVendor Advisory
https://www.vulncheck.com/advisories/dr-ger-infinity-explorer-c700-privilege-escalation-via-kiosk-mode-bypassThird Party AdvisoryVDB Entry

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2019-25718 being actively exploited?

CVE-2019-25718 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.12%.

How severe is CVE-2019-25718?

CVE-2019-25718 has a CVSS 3.1 base score of 8.4, rated high. EPSS estimates a 0.12% probability of exploitation.

Which products are affected by CVE-2019-25718?

Affected products include Draeger Infinity Explorer C700 Firmware.

How do I fix CVE-2019-25718?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2019-25718 against the real software inventory on every managed device, as each hourly inventory arrives. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo