CVE-2025-15653

Dräger Zeus IE Anesthesia Workstation USB Interface Privilege Escalation

State: Published
Severity: 7.0 High
Published: Jun 2, 2026
Updated: Jun 3, 2026
Reserved: Jun 2, 2026

Description

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N	VulnCheck
3.1	6.8 Medium	CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	VulnCheck

Weaknesses

CWE-668 Exposure of Resource to Wrong Sphere

Affected Products

Product	Versions
Zeus IEDräger	before 1.0.5Affected
Zeus RS C500Dräger	before 1.0.9Affected

References

https://static.draeger.com/security/download/Product-Security-Advisory-25-349-Zeus.pdfvendor-advisory
https://www.vulncheck.com/advisories/dr-ger-zeus-ie-anesthesia-workstation-usb-interface-privilege-escalationthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.