VDE-2025-028
Last update
08/05/2025 12:00
Published at
08/05/2025 12:00
Vendor(s)
Drägerwerk AG & Co. KGaA
External ID
VDE-2025-028
CSAF Document
Summary
A security vulnerability was identified in the ICMHelper service running on the system of an ICM installation.
A low privileged local attacker could exploit this vulnerability to issue OS commands with the highest privileges.
Impact
The vulnerability CVE-2025-41698 allows an attacker to gain full access to application, sensitive information, client system and server. This requires successful exploitation of CVE-2025-2810.
Affected Product(s)
| Model no. | Product name | Affected versions |
|---|---|---|
| Draeger ICMHelper <=1.4.0.1 | Draeger ICMHelper <=1.4.0.1 |
Vulnerabilities
Expand / Collapse all
Published
09/22/2025 14:57
Severity
Weakness
Missing Authorization (CWE-862)
Summary
A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.
References
Published
09/22/2025 14:57
Severity
Weakness
Use of Hard-coded Cryptographic Key (CWE-321)
Summary
A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key.
References
Remediation
The issue has been fixed in ICMHelper version 2.0.1.0.
Revision History
| Version | Date | Summary |
|---|---|---|
| 1 | 08/05/2025 12:00 | Initial revision. |