Vulnerability details

CVE-2025-15653

Dräger Zeus IEDräger Zeus RS C500

Dräger Zeus IE Anesthesia Workstation USB Interface Privilege Escalation

CVSS 4.0

7.0High

Official description

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.

CVSS scores

Score	Version	Source	Vector
7.0High	4.0	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N`
6.8Medium	3.1	CVEProject cvelistV5 (CNA) (VulnCheck)	`CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Dräger	Zeus IE	v < 1.0.5	CVEProject cvelistV5 (CNA)
Dräger	Zeus RS C500	v < 1.0.9	CVEProject cvelistV5 (CNA)

References and advisories

https://static.draeger.com/security/download/Product-Security-Advisory-25-349-Zeus.pdf vendor-advisory
https://www.vulncheck.com/advisories/dr-ger-zeus-ie-anesthesia-workstation-usb-interface-privilege-escalation third-party-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-06-03
Last updated: 2026-06-03
State: Published
Assigner (CNA): VulnCheck

Exploit prediction (EPSS)

0.16%

Probability of exploitation in 30 days

6.3%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: No
Exploitation: None
Technical impact: Total

Weaknesses (CWE)

CWE-668
Exposure of Resource to Wrong Sphere