Dräger Atlan A350 Denial-of-Service Vulnerability via Medibus Interface

A denial-of-service vulnerability has been identified in the Dräger Atlan A350 software, specifically in versions 1.00 through 1.01. The issue arises from improper input handling that allows attackers to disrupt device operation by sending specially crafted, non-Medibus-compliant data through the Medibus interface. This malformed data can overload the internal processor, causing a gradual disruption in device functionality over several hours. The impact includes loss of data transmission, delayed updates of real-time monitoring curves, and discrepancies between displayed airway pressure values and the corresponding screen curves.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing prolonged disruption of the device's normal operations. This results in a loss of data transmission, delays in the real-time display of monitoring curves, and inconsistencies in airway pressure readings.