Dräger Zeus Anesthesia Workstation CVE-2025-15653

Exploitation requires physical access to a USB port on a Dräger Zeus Infinity Empowered (Zeus IE) or Zeus RS C500 anesthesia workstation - typically meaning attacker presence in the operating room, post-anesthesia care area, or storage space where the device sits - combined with the device being powered on and the USB interface unprotected by port blockers, kiosk lockdown, or operator supervision. CVSS 4.0 specifies AV:P (Physical) and PR:N/UI:N, so no credentials and no operator interaction at the device console are required once an attacker can reach the port. Pivot to broader networks additionally requires the workstation to be connected to a hospital network or to Dräger Service Connect at the time of compromise; air-gapped or standalone deployments limit impact to the device itself. Remote, network-based exploitation is not possible.

The CVSS 4.0 vector AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H clearly bounds this as a physical-access attack with high confidentiality, integrity, and availability impact on the vulnerable system but no scope change (SC:N/SI:N/SA:N) - meaning the CVSS model itself does not credit the described network-pivot consequence. EPSS data was not provided and the CVE is not on CISA KEV, with no POC published, so by quantitative signals this is not a mass-exploitation priority. However, the qualitative risk is meaningfully higher than the 7.0 score suggests because (a) the targets are life-critical medical devices where integrity loss can directly harm patients, (b) operating-room environments routinely admit USB drives for clinical engineering and updates, and (c) the description explicitly notes the device can be used as a network pivot, a downstream consequence CVSS 4.0 does not score here. The mismatch between the description's network-pivot claim and the SC:N/SI:N/SA:N subsequent-system metrics should be verified with Dräger before deciding whether to treat this as a contained device flaw or a beachhead risk to hospital networks.

An insider, contracted vendor, or intruder with brief unsupervised access to the anesthesia workstation between procedures inserts a malicious USB device - a mass-storage drive carrying tampered configuration, or a HID/peripheral emulator - into an unprotected port on the Zeus IE or Zeus RS C500. The device then accepts the manipulated input, allowing the attacker to alter therapy parameters, exfiltrate or corrupt patient data processed by the workstation, and, if the device is networked to hospital infrastructure or Dräger Service Connect, use the foothold to reach upstream systems. No public exploit is identified at time of analysis, so any active attempt would likely require attacker-developed tooling.