Medium severity · published Jun 2, 2026
CVE-2025-15653
Dräger Zeus IE Anesthesia Workstation USB Interface Privilege Escalation
6.8
CVSS
0.2%
EPSS
No
On KEV
Description
Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 6% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ZI
Zeus IE · Dräger
before 1.0.5 · source: vendor
ZR
Zeus RS C500 · Dräger
before 1.0.9 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-15653
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-15653
static.draeger.com
https://static.draeger.com/security/download/Product-Security-Advisory-25-349-Zeus.pdf
www.vulncheck.com
https://www.vulncheck.com/advisories/dr-ger-zeus-ie-anesthesia-workstation-usb-interface-privilege-escalation
