Resource exhaustion in Dräger Core
CVE-2024-14036
Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-adjacent attackers to trigger high CPU load by sending specially crafted, unencrypted SDC messages during the discovery process. Attackers with access to the hospital network can send malformed SDC packets to exhaust CPU resources in the affected process, causing further SDC messages to no longer be processed.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.003 (19.6th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 20th percentile — 19.6% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.003 · newest: 0.003 · change: 0.000
Affected products
- Dräger Core — versions 0
- Dräger M540 Converter Service — versions 0
Weakness classification (CWE)
References
- static.draeger.com/security (vendor-advisory)
- www.vulncheck.com/advisories/dr-ger-core-denial-of-service-via-malformed-sdc-me… (third-party-advisory)
- static.draeger.com/security/download/PSA-24-110-1-gSOAP-Product-Security-Adviso… (vendor-advisory)
Frequently asked questions
- What is CVE-2024-14036?
- CVE-2024-14036 is a high-severity vulnerability in Dräger Core, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-06-02.
- How severe is CVE-2024-14036?
- High severity. CVSS v3 base score is 7.5 out of 10.