PT-2026-45863 · Dräger · M540 Converter Service+1

CVE-2024-14036 · Published 2026-06-02 · Updated 2026-06-03

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Dräger Core version 1.0.5 Dräger M540 Converter Service version 1.0.9

Description A denial of service issue allows network-adjacent attackers to trigger high CPU load by sending specially crafted, unencrypted SDC (Service-oriented Device Connectivity) messages during the discovery process. Attackers with access to the hospital network can send malformed SDC packets to exhaust CPU resources in the affected process, preventing further SDC messages from being processed.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2024-14036

Affected Products

Core

M540 Converter Service

References · 7

• https://static.draeger.com/security · Vendor Advisory
• https://static.draeger.com/security/download/PSA-24-110-1-gSOAP-Product-Security-Advisory.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-14036 · Security Note
• https://t.me/cveNotify/165872 · Telegram Post
• https://vulncheck.com/advisories/dr-ger-core-denial-of-service-via-malformed-sdc-message · Note
• https://twitter.com/CVEnew/status/2061993221530456274 · Twitter Post
• https://t.me/CVEtracker/55661 · Telegram Post