Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password
Priority LOW 28CWE-256Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-256.
Summary
An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating users.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00218 12th percentileScored 2026-11-07
Fix Fixed Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi): 2.0.1.3Agilia Partner (Fresenius Kabi): 3.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fresenius Kabi | Vigilant Software Suite (Mastermed Dashboard) | before 2.0.1.3 | 2.0.1.3 | Patch available | CNA |
| Fresenius Kabi | Agilia Partner | before 3.0 | 3.0 | Patch available | CNA |
- Vigilant Software Suite (Mastermed Dashboard) VendorFresenius Kabi Affected before 2.0.1.3 Fixed in 2.0.1.3 Patch available CNA
- Agilia Partner VendorFresenius Kabi Affected before 3.0 Fixed in 3.0 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fresenius-kabi:agilia_connect:*:*:*:*:*:*:*:* | up to d25 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* | up to 3.3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* | 3.0 d15 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
- cpe:2.3:o:fresenius-kabi:agilia_connect:*:*:*:*:*:*:*:* Versions up to d25 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* Versions up to 3.3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* Versions 3.0 d15 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
Remediation
- Fix · CNA Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi) Fixed in 2.0.1.3
- Fix · CNA Agilia Partner (Fresenius Kabi) Fixed in 3.0
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) 2.0.1.3
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authenticationPriority MEDIUM 50
- TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentialsPriority LOW 39
- TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmPriority LOW 33
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23207
- 2026-10-03 Alias added: GHSA-4r23-36c8-4wg2
References
More Fresenius Kabi Agilia Connect vulnerabilities
- TI-2021-18458 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1HIGH 7.5
Sources
- CVE-2021-23207 · CVE Program
- CVE-2021-23207 · NVD
- FIRST EPSS
- GHSA-4r23-36c8-4wg2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences