Fresenius Kabi Agilia Connect Infusion System use of client side authentication
Priority MEDIUM 50CWE-603Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-287.
Summary
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00978 62nd percentileScored 2026-11-07
Fix Fixed Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi): 2.0.1.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fresenius Kabi | Vigilant Software Suite (Mastermed Dashboard) | before 2.0.1.3 | 2.0.1.3 | Patch available | CNA |
- Vigilant Software Suite (Mastermed Dashboard) VendorFresenius Kabi Affected before 2.0.1.3 Fixed in 2.0.1.3 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* | up to 3.3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* | up to d25 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* | 3.0 d15 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
- cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* Versions up to 3.3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* Versions up to d25 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* Versions 3.0 d15 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
Remediation
- Fix · CNA Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi) Fixed in 2.0.1.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) 2.0.1.3
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentialsPriority LOW 39
- TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmPriority LOW 33
- TI-2021-05963 Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listingPriority LOW 32
Timeline
- 2026-10-02 Threatist record created from CVE-2021-43355
- 2026-10-03 Alias added: GHSA-gc9x-xj3h-72v9
References
More Fresenius Kabi Agilia Connect Firmware vulnerabilities
- TI-2021-05987 Fresenius Kabi Agilia Connect Infusion System CVSS 3.1CRITICAL 9.8
- TI-2021-05964 Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials CVSS 3.1CRITICAL 9.8
- TI-2021-11677 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1CRITICAL 9.1
- TI-2021-05988 Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption CVSS 3.1HIGH 7.5
- TI-2021-20073 Fresenius Kabi Agilia Connect Infusion System hard coded credentials CVSS 3.1HIGH 8.8
- TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1HIGH 7.2
Sources
- CVE-2021-43355 · CVE Program
- CVE-2021-43355 · NVD
- FIRST EPSS
- GHSA-gc9x-xj3h-72v9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences