CVE-2025-15653

Dräger Zeus IE Anesthesia Workstation USB Interface Privilege Escalation

CVSS 7 HIGHEPSS 0.2%CWE-668

Vexday Risk Score

21Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 7EPSS 0.2%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado

Lifecycle

02 Jun 2026Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Affected products

Dräger · Zeus IE Dräger · Zeus RS C500

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://static.draeger.com/security/download/Product-Security-Advisory-25-349-Zeus.pdf https://www.vulncheck.com/advisories/dr-ger-zeus-ie-anesthesia-workstation-usb-interface-privilege-escalation