CVE-2025-15653

Vulnerability

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations have a local security vulnerability. Unauthorized individuals with physical access can exploit unprotected USB interfaces to compromise software integrity. This vulnerability affects the integrity of therapy functions and device-processed data [1].

Exploitation

Attackers require physical access to the affected Dräger anesthesia workstations. By manipulating the unprotected USB interfaces, an attacker can exploit this vulnerability. The specific steps involve interacting with the USB ports to gain unauthorized access and modify the device's software integrity [1].

Impact

Successful exploitation allows attackers to impair therapy functions, manipulate device-processed data, or use the compromised device as a pivot point for broader network-based attacks, especially when the workstation is connected to a network or Dräger Service Connect. This compromises the confidentiality and integrity of patient data and therapeutic operations [1].

Mitigation

Not yet disclosed in the available references. No patched version or workaround has been published at this time [1].