What’s Vulnerable › Vulnerabilities

CVE-2021-23196: Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-21 · updated 2026-06-17
• Weakness: CWE-522

Description

The web application on Agilia Link+ version 3.0 implements authentication and session management mechanisms exclusively on the client-side and does not protect authentication attributes sufficiently.

Affected products

• Fresenius-Kabi Agilia Connect Firmware: through d25
• Fresenius-Kabi Agilia Partner Maintenance Software: through 3.3.0
• Fresenius-Kabi Link+ Agilia Firmware: before 3.0; 3.0, 3.0-d15 — fixed in 3.0
• Fresenius-Kabi Vigilant Centerium: 1.0
• Fresenius-Kabi Vigilant Insight: 1.0
• Fresenius-Kabi Vigilant Mastermed: 1.0

How to fix

Upgrade to a fixed version: Fresenius-Kabi Link+ Agilia Firmware 3.0. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
• https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

Get alerted when CVE-2021-23196 or the next vulnerability affects your stack