Vulnerability in Dräger Zeus Ie
CVE-2025-15653
Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 6.8 (Medium). Vector: CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.002 (5.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 6th percentile — 5.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Dräger Zeus Ie — versions 0
- Dräger Zeus Rs C500 — versions 0
Weakness classification (CWE)
References
- www.draeger.com/security (vendor-advisory)
- www.vulncheck.com/advisories/dr-ger-zeus-ie-anesthesia-workstation-usb-interfac… (third-party-advisory)
- static.draeger.com/security/download/Product-Security-Advisory-25-349-Zeus.pdf (vendor-advisory)
Frequently asked questions
- What is CVE-2025-15653?
- CVE-2025-15653 is a medium-severity vulnerability in Dräger Zeus Ie, classified under Exposure of Resource to Wrong Sphere. CVSS score: 6.8/10. Published 2026-06-02.
- How severe is CVE-2025-15653?
- Medium severity. CVSS v3 base score is 6.8 out of 10.