Resource exhaustion in Dräger Core
CVE-2024-14036
Dräger Core 1.0.5 and Dräger M540 Converter Service 1.0.9 contain a denial of service vulnerability that allows network-adjacent attackers to trigger high CPU load by sending specially crafted, unencrypted SDC messages during the discovery process. Attackers with access to the hospital network can send malformed SDC packets to exhaust CPU resources in the affected process, causing further SDC messages to no longer be processed.
Vulnerability class: DoS (Denial of Service)
EPSS: 0.003 (20.6th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
Affected products
- Dräger Core — versions 0
- Dräger M540 Converter Service — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)
- disclosure@vulncheck.com (vendor-advisory)
Frequently asked questions
- What is CVE-2024-14036?
- CVE-2024-14036 is a high-severity vulnerability in Dräger Core, classified under Uncontrolled Resource Consumption. CVSS score: 7.5/10. Published 2026-06-02.
- How severe is CVE-2024-14036?
- High severity. CVSS v3 base score is 7.5 out of 10.