Fresenius Kabi Agilia Connect Infusion System hard coded credentials
Priority LOW 39CWE-798Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-798.
Summary
Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession of the password may gain privileges on all installations of this software.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0064 50th percentileScored 2026-11-07
Fix Fixed Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi): 2.0.1.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Fresenius Kabi | Vigilant Software Suite (Mastermed Dashboard) | before 2.0.1.3 | 2.0.1.3 | Patch available | CNA |
- Vigilant Software Suite (Mastermed Dashboard) VendorFresenius Kabi Affected before 2.0.1.3 Fixed in 2.0.1.3 Patch available CNA
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* | up to d25 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* | up to 3.3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* | before 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* | 3.0 | Vulnerable | Fresenius Kabi |
| cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* | 3.0 d15 | Vulnerable | Fresenius Kabi |
| cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Fresenius Kabi |
- cpe:2.3:o:fresenius-kabi:agilia_connect_firmware:*:*:*:*:*:*:*:* Versions up to d25 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:agilia_connect:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:agilia_partner_maintenance_software:*:*:*:*:*:*:*:* Versions up to 3.3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_centerium:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_insight:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:a:fresenius-kabi:vigilant_mastermed:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:-:*:*:*:*:*:* Versions 3.0 Vulnerable ·Fresenius Kabi
- cpe:2.3:o:fresenius-kabi:link\+_agilia_firmware:3.0:d15:*:*:*:*:*:* Versions 3.0 d15 Vulnerable ·Fresenius Kabi
- cpe:2.3:h:fresenius-kabi:link\+_agilia:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Fresenius Kabi
Remediation
- Fix · CNA Vigilant Software Suite (Mastermed Dashboard) (Fresenius Kabi) Fixed in 2.0.1.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) 2.0.1.3
6 records Highest priority Priority MEDIUM 1 MEDIUM, 5 LOW
Other records, highest priority first
- TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authenticationPriority MEDIUM 50
- TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithmPriority LOW 33
- TI-2021-05963 Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listingPriority LOW 32
Timeline
- 2026-10-02 Threatist record created from CVE-2021-44464
- 2026-10-03 Alias added: GHSA-jpmr-g8fr-7x23
- 2026-10-23 EPSS moved to the 50th–90th percentile
References
More Fresenius Kabi Agilia Connect Firmware vulnerabilities
- TI-2021-19327 Fresenius Kabi Agilia Connect Infusion System use of client side authentication CVSS 3.1CRITICAL 9.8
- TI-2021-05987 Fresenius Kabi Agilia Connect Infusion System CVSS 3.1CRITICAL 9.8
- TI-2021-05964 Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials CVSS 3.1CRITICAL 9.8
- TI-2021-11677 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1CRITICAL 9.1
- TI-2021-05988 Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption CVSS 3.1HIGH 7.5
- TI-2021-13191 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm CVSS 3.1HIGH 7.2
Sources
- CVE-2021-44464 · CVE Program
- CVE-2021-44464 · NVD
- FIRST EPSS
- GHSA-jpmr-g8fr-7x23 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences