Skip to content
OpenAdvisories
High ICSMA-21-355-01 13 CVEs

Fresenius Kabi Agilia Connect Infusion System (Update A)

Published Dec 21, 2021 · Updated Jan 27, 2022 · Revision 2

Vendor: Fresenius Kabi Product: Agilia Connect WiFi module of the pumps Product: Agilia Link+ Product: Agilia Partner maintenance software

Summary

Successful exploitation of these vulnerabilities in system accessories could allow an attacker to gain access to sensitive information, modify settings or parameters, or perform arbitrary actions as an authenticated user.

Vulnerabilities 13

  • High 7.5
    CVE-2021-23236

    Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption

    Requests may be used to interrupt the normal operation of the device. When exploited, Fresenius Kabi Agilia Link+ version 3.0 must be rebooted via a hard reset triggered by pressing a button on the rack system.

    Fresenius Kabi Agilia Link+
  • High 7.3
    CVE-2021-23196

    Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials

    The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently.

    Fresenius Kabi Agilia Link+
  • High 7.3
    CVE-2021-23233

    Fresenius Kabi Agilia Connect Infusion System

    Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or…

    Fresenius Kabi Agilia Link+
  • High 7.3
    CVE-2021-41835

    Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

    Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect …

    Fresenius Kabi Agilia Link+
  • High 7.3
    CVE-2021-43355

    Fresenius Kabi Agilia Connect Infusion System use of client side authentication

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support o…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 6.5
    CVE-2021-23207

    Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password

    An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ que…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) Agilia Partner
  • Medium 6.5
    CVE-2021-31562

    Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

    The SSL/TLS configuration of Fresenius Kabi Agilia Link + version 3.0 has serious deficiencies that may allow an attacker to compromise SSL/TLS sessions in different ways. An attacker may be able to eavesdrop on transferred data, manipulate data allegedly sec…

    Fresenius Kabi Agilia Link+
  • Medium 6.3
    CVE-2021-44464

    Fresenius Kabi Agilia Connect Infusion System hard coded credentials

    Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 contains service credentials likely to be common across all instances. An attacker in possession of the password may gain privileges on all installations of this software.

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 5.9
    CVE-2021-33846

    Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitra…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 5.4
    CVE-2021-33848

    Fresenius Kabi Agilia Connect Infusion System cross site scripting

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 is vulnerable to reflected cross-site scripting attacks. An attacker could inject JavaScript in a GET parameter of HTTP requests and perform unauthorized actions such as stealing int…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 5.3
    CVE-2021-23195

    Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exis…

    Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
  • Medium 5.3
    CVE-2021-33843

    Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external parties

    Fresenius Kabi Agilia SP MC WiFi vD25 and prior has a default configuration page accessible without authentication. An attacker may use this functionality to change the exposed configuration values such as network settings.

    Fresenius Kabi Agilia Connect WiFi
  • Unscored —
    CVE-2020-35340

    A local file inclusion vulnerability in ExpertPDF 9.5.0 through 14.1.0 allows attackers to read the file contents from …

Revision history

  1. #2

    ICSMA-21-355-01 Fresenius Kabi Agilia Connect Infusion System (Update A)

  2. #1

    ICSMA-21-355-01 Fresenius Kabi Agilia Connect Infusion System

References