Security readout for executives and security teams
Plain-English summary
This vulnerability affects Dräger Infinity patient monitoring systems and can let a remote, unauthenticated attacker disrupt monitoring or alter network-delivered settings. In clinical environments, the business concern is patient safety disruption, alarm reliability, and operational downtime rather than data theft.
Executive priority
Treat this as high priority where affected monitors support active care areas. The key urgency is reducing preventable disruption to patient monitoring while coordinating any changes through clinical operations and vendor support.
Technical view
CVE-2022-4992 is a CWE-345 improper verification issue in network message handling. Spoofed or tampered network messages may modify settings such as alarm states or limits, while excessive traffic can cause Cockpit or M540 reboot and loss of network functionality.
Likely exposure
Exposure is most relevant to healthcare environments running Dräger Infinity Acute Care System or Standalone Infinity M540 patient monitors on VG4.1.1, VG4.0.3, lower versions, or partially affected VG4.2 deployments.
Exploitation context
The provided sources do not state active exploitation, and this CVE is not marked KEV. Risk still matters because attack requirements are low: network access, no privileges, and no user interaction.
Researcher notes
The source bundle identifies impact and affected version families but does not provide exploit evidence or a complete fix matrix. Validate against the vendor advisory before declaring remediation complete.
Mitigation direction
- Review Dräger PSA-19-255-03 and current Dräger guidance for approved remediation.
- Confirm affected software versions with biomedical engineering or the device owner.
- Prioritize vendor-approved updates or compensating controls for exposed clinical networks.
- Limit unnecessary network reachability to affected monitoring systems under existing clinical policy.
Validation and detection
- Inventory Dräger Infinity Acute Care System and Standalone Infinity M540 deployments.
- Identify devices running VG4.1.1, VG4.0.3, lower versions, or VG4.2.
- Check whether affected devices are reachable from non-clinical or unmanaged networks.
- Review operational records for unexpected reboots, lost network functionality, or alarm-setting anomalies.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-345: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-4992 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.8 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N——VulnCheckCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H3.94.7VulnCheckVulnerability scoring details
Base CVSS 4.0 score
8.8HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://static.draeger.com/security/download/PSA-19-255-03_Product-Security-Advisory-IACS.pdfCVE reference, VulnCheck · vendor-advisory
- https://www.vulncheck.com/advisories/dr-ger-infinity-m540-vg4-spoofed-network-message-handling-dos-tamperingCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Insufficient Verification of Data Authenticity
Insufficient Verification of Data Authenticity represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.