Read the docs
TI-2021-13193 Aliases CVE-2021-33848GHSA-3r3c-xv8w-hfp3

Fresenius Kabi Agilia Connect Infusion System cross site scripting

Priority LOW 28CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing internal information and performing actions in context of an authenticated user.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00611 49th percentileScored 2026-11-07
Fix Fixed Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi): 2.0.1.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Fresenius KabiVigilant Software Suite (Mastermed Dashboard)before 2.0.1.32.0.1.3Patch availableCNA
  • Vigilant Software Suite (Mastermed Dashboard) VendorFresenius Kabi Affected before 2.0.1.3 Fixed in 2.0.1.3 Patch available CNA

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:*up to d25VulnerableFresenius Kabi
cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:*not specified by NVDRunning onFresenius Kabi
cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:*up to 3.3.0VulnerableFresenius Kabi
cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:*1.0VulnerableFresenius Kabi
cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:*1.0VulnerableFresenius Kabi
cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:*1.0VulnerableFresenius Kabi
cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:*before 3.0VulnerableFresenius Kabi
cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:*3.0VulnerableFresenius Kabi
cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:*3.0 d15VulnerableFresenius Kabi
cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:*not specified by NVDRunning onFresenius Kabi
  • cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* Versions up to d25 Vulnerable ·Fresenius Kabi
  • cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
  • cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* Versions up to 3.3.0 Vulnerable ·Fresenius Kabi
  • cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
  • cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
  • cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
  • cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Fresenius Kabi
  • cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Fresenius Kabi
  • cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* Versions 3.0 d15 Vulnerable ·Fresenius Kabi
  • cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi

Remediation

  • Fix · CNA Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi) Fixed in 2.0.1.3

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) 2.0.1.3

    6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW

    Other records, highest priority first

    • TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authenticationPriority MEDIUM 50
    • TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentialsPriority LOW 39
    • TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmPriority LOW 33
    Show all 6 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-33848
  2. 2026-10-03 Alias added: GHSA-3r3c-xv8w-hfp3

References

Advisory 1

  • TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authentication CVSS 3.1CRITICAL 9.8
  • TI-2021-05987 Fresenius Kabi Agilia Connect Infusion System CVSS 3.1CRITICAL 9.8
  • TI-2021-05964 Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials CVSS 3.1CRITICAL 9.8
  • TI-2021-11677 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1CRITICAL 9.1
  • TI-2021-05988 Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption CVSS 3.1HIGH 7.5
  • TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentials CVSS 3.1HIGH 8.8
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences