Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing
Priority LOW 32CWE-548Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-200.
Summary
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exist and directory listing is enabled, all content of the directory will be displayed, allowing an attacker to identify and access files on the server.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00845 58th percentileScored 2026-11-07
Fix Fixed Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi): 2.0.1.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fresenius Kabi | Vigilant Software Suite (Mastermed Dashboard) | before 2.0.1.3 | 2.0.1.3 | Patch available | CNA |
- Vigilant Software Suite (Mastermed Dashboard) VendorFresenius Kabi Affected before 2.0.1.3 Fixed in 2.0.1.3 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* | up to d25 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* | up to 3.3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* | 3.0 d15 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
- cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* Versions up to d25 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* Versions up to 3.3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* Versions 3.0 d15 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
Remediation
- Fix · CNA Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi) Fixed in 2.0.1.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) 2.0.1.3
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authenticationPriority MEDIUM 50
- TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentialsPriority LOW 39
- TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmPriority LOW 33
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23195
- 2026-10-03 Alias added: GHSA-29g2-4fxx-7xmh
References
More Fresenius Kabi Agilia Connect Firmware vulnerabilities
- TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authentication CVSS 3.1CRITICAL 9.8
- TI-2021-05987 Fresenius Kabi Agilia Connect Infusion System CVSS 3.1CRITICAL 9.8
- TI-2021-05964 Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials CVSS 3.1CRITICAL 9.8
- TI-2021-11677 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1CRITICAL 9.1
- TI-2021-05988 Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption CVSS 3.1HIGH 7.5
- TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentials CVSS 3.1HIGH 8.8
Sources
- CVE-2021-23195 · CVE Program
- CVE-2021-23195 · NVD
- FIRST EPSS
- GHSA-29g2-4fxx-7xmh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences