CVE-2025-15653

MediumCVSS 6.8/10Last modified Jul 22, 2026

Description

Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-668

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 2, 2026
Last modified: Jul 22, 2026
NVD status: Awaiting Analysis

Related CVEs from 2025

CVE-2025-156547.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fox-themes Prague allows Reflected XSS CVE-2025-156557.6Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Mojoomla School Management allows SQL CVE-2025-156568.8Incorrect Privilege Assignment vulnerability in Mojoomla School Management allows Privilege Escalation. This issue affects School Managemen CVE-2025-156575.3Unauthenticated Insecure Direct Object References (IDOR) in School Management <= 93.1.0 versions.CVE-2025-156585.9Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.CVE-2025-156596.5Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.CVE-2025-15667.5DNS Leak in Native System VPN in Google ChromeOS Dev Channel on ChromeOS 16002.23.0 allows network observers to expose plaintext DNS queries CVE-2025-156616.5libssh2 through 1.11.1, fixed in commit 2dae302, contains an out-of-bounds heap read vulnerability in the sftp_symlink() function in src/sft CVE-2025-156628.6The Printcart Web to Print Product Designer for WooCommerce WordPress plugin before 2.5.3 does not restrict a user-supplied URL before fetch CVE-2025-156636.8The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value bef CVE-2025-156646.8The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value be CVE-2025-156655.4The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.1 does not escape the value of the BEAF Slider widget's shortc