Z-0258-2020Class II

The Infinity Acute Care System (IACS) Monitoring Solution with the Standalone Infinity M540 patient monitor...

Name: Z-0258-2020 The Infinity Acute Care System (IACS) Monitoring Solution with the Standalone Infinity M540 patient monitor...
Creator: Draegar Medical Systems, Inc.
Published: 2019-09-13
License: https://open.fda.gov/license/

Draeger Medical Systems, Inc. / initiated 2019-09-13 / Open, Classified / root cause: software

FDA source

Draegar Medical Systems, Inc. began a recall of The Infinity Acute Care System (IACS) Monitoring Solution with the Standalone Infinity M540 patient monitor. Model nos. MS25510, MS25520, MS26372 on 2019-09-13. FDA classified it as Class II and gives the reason as "Cybersecurity vulnerabilities may cause device to reboot, lose alarm functionality, and/or lose communication with cockpit and/or the Infinity Network". As of 2026-09-10, the recall status on record is Open, Classified, and MDM tags the root cause as software.

Recall record

Recall number: Z-0258-2020
Classification: Class II
Status: Open, Classified
Initiated: 2019-09-13
Posted: 2019-10-31
Recalling firm: Draeger Medical Systems, Inc.
Product: The Infinity Acute Care System (IACS) Monitoring Solution with the Standalone Infinity M540 patient monitor. Model nos. MS25510, MS25520, MS26372.
Product code: MHX Monitor, Physiological, Patient(With Arrhythmia Detection Or Alarms)
Reason for recall: Cybersecurity vulnerabilities may cause device to reboot, lose alarm functionality, and/or lose communication with cockpit and/or the Infinity Network.
Root cause tag: software
FDA root cause: Software design
Action: On September 13, 2019, the firm distributed Urgent Medical Device Recall letters to customers. Customers were informed of the cybersecurity vulnerabilities, which can include Distributed Denial of Service (DDOS) (packet storm), Spoofing, and Tampering. To mitigate the cybersecurity concerns, Draeger will be releasing software version VG4.2 for both the Cockpit and the M540, which will correct these cybersecurity vulnerabilities. The software is expected to be released for distribution in December 2019. Upgrades of the IACS systems will commence in January 2020. While the firm is in the process of updating the software, customers are asked to limit access to the Infinity Network by following these security recommendations: 1. Physical security of the patient monitors is recommended and is the responsibility of the operating organization. 2. Physical security of the telecommunications closet is recommended and is the responsibility of the operating organization. 3. Draeger recommends that operating organizations restrict physical access to unused Ethernet ports on the IACS. 4. Draeger recommends that operating organizations restrict physical access to unused USB and serial ports on the IACS. 5. Draeger relies on the medical device isolation mechanism of the VLANs and the proper configuration, implementation, and use of the operating organization's security measures to prevent the introduction of malware onto the Infinity Network. Your local Draeger Service Representative will contact you to schedule an appointment to upgrade your system(s) software free of charge once the new software version is released for distribution. If you have any questions regarding this letter, please contact Michael Kelhart between the hours of 8:00 AM - 4:30 PM EST at 1-800-437-2437 (press 1 at the prompt, then 32349).
Quantity in commerce: 5634
Distribution: US Nationwide distribution.
Product codes and lots: Software version VG4.1.1/VG4.0.3 and lower

Enforcement reports

One row per recalled product line

FDA enforcement reports joined to recall event Z-0258-2020
Recall number	Class	Status	Voluntary or mandated	Report date	Classified
Z-0258-2020	Class II	Ongoing	Voluntary: Firm initiated	2019-11-06	2019-10-31

Product code MHX

MDM coverage of this record lists here, newest first.

About this record

Sourced from the FDA device recall database and the FDA enforcement reports, both ingested from openFDA. The recall record supplies the product, the reason and the product code; the enforcement report supplies the classification. The two datasets are exported by FDA on different days, and the date above is the older of the two, so nothing on this page is newer than it says.

MDM adds the root cause tag, derived from FDA’s own root cause text, and the cross-links to the product code, the clearances named on the record and MDM coverage. Where a recall has not been joined to an enforcement report, no classification is shown.

Data as of 2026-09-30, the FDA export date for this dataset. Page last changed 2026-09-05. View this recall on fda.gov (opens on fda.gov)