Dräger Zeus Infinity Empowered and Zeus RS C500 anesthesia workstations contain a local privilege escalation vulnerability that originates from unprotected USB interfaces; because the USB ports are exposed without authentication, an attacker who gains physical access can manipulate the device’s software integrity, disrupting therapy functions and altering data that the device processes, thereby threatening patient safety and potentially establishing a pivot for further network attacks if the workstation is connected to a network or Dräger Service Connect.

The affected products are Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations. Specific model and firmware versions are not disclosed in the advisory, but the vulnerability applies to all units of these two product lines that have the unprotected USB interface.

The advisory assigns a CVSS score of 7, indicating high severity. The EPSS score is not available, so an explicit estimate of exploitation probability cannot be given, but physical access is required, making the attack vector relatively constrained. The vulnerability is not listed in CISA’s KEV catalog, so no known exploits have been recorded yet. However, the potential impact on safety-critical medical functions makes it a significant risk if the workstation is not promptly patched or otherwise protected.