Skip to content
OpenAdvisories
High VDE-2025-028 2 CVEs

Draeger: ICMHelper is vulnerable to a privilege escalation

Published Aug 5, 2025 · Updated Jan 6, 2026 · Revision 3

Vendor: Draeger Product: ICMHelper

Summary

A security vulnerability was identified in the ICMHelper service running on the system of an ICM installation.
A low privileged local attacker could exploit this vulnerability to issue OS commands with the highest privileges.

Details

Impact
The vulnerability CVE-2025-41698 allows an attacker to gain full access to application, sensitive information, client system and server. This requires successful exploitation of CVE-2025-2810.

Remediation
The issue has been fixed in ICMHelper version 2.0.1.0.

Vulnerabilities 2

  • High 7.8
    CVE-2025-41698

    Draeger: ICMHelper is vulnerable to a privilege escalation due too missing authorization

    A low privileged local attacker can interact with the affected service although user-interaction should not be allowed.

    Draeger Draeger ICMHelper
  • Medium 5.5
    CVE-2025-2810

    Draeger: ICMHelper is vulnerable to use of Hard-coded Cryptographic Key

    A low privileged local attacker can abuse the affected service by using a hardcoded cryptographic key.

    Draeger Draeger ICMHelper

Revision history

  1. #3.0.0

    fixed version range, fixed Aggregate severity, changed vulnerability Title to CVE description, fix CPE to have at least one for affected products

  2. #2.0.0

    Changes to publisher Added CPEs as product_identification_helper

  3. #1.0.0

    Initial revision.

References