CVE-2018-19012 Security feature bypass in Dräger Infinity Delta
Attackers can bypass kiosk mode to access the underlying operating system and gain control of Drager Infinity Delta medical devices.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-19012?
CVE-2018-19012 is a high-severity vulnerability in ICS-CERT Dräger Infinity Delta, published on 28 Jan 2019. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Drager Infinity Delta, Infinity Delta, all versions, Delta XL, all versions, Kappa, all version, and Infinity Explorer C700, all versions. Via a specific dialog it is possible to break out of the kiosk mode and reach the underlying operating system. By breaking out of the kiosk mode, an attacker is able to take control of the operating system.
Weakness: CWE-269
Which versions are affected by CVE-2018-19012?
It affects 4 products.
Products include Draeger Delta Xl Firmware, Draeger Infinity Delta Firmware, Draeger Infinity Explorer C700 Firmware, Draeger Kappa Firmware.
How do I fix CVE-2018-19012?
No fix has been published for CVE-2018-19012 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-19012 being exploited?
There is no known exploitation of CVE-2018-19012 in the wild and no public exploit code.
Other vulnerabilities in ICS-CERT Dräger Infinity Delta
- CVE-2019-25716 Dräger Infinity Delta/Kappa Patient Monitor DoS via Malformed Network Packet
- CVE-2018-19010 Denial of service in Dräger Infinity Delta
- CVE-2018-19014 Information disclosure in Dräger Infinity Delta
- CVE-2019-25717 Dräger Infinity Delta/Kappa Patient Monitors Unauthenticated Log File Disclosure
Sources
Also known as GHSA-423c-8p99-7j35.