What’s Vulnerable › Vulnerabilities

CVE-2021-33846: Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-01-21 · updated 2026-06-17
• Weakness: CWE-327

Description

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 issues authentication tokens to authenticated users that are signed with a symmetric encryption key. An attacker in possession of the key can issue valid JWTs and impersonate arbitrary users.

Affected products

• Fresenius-Kabi Agilia Connect Firmware: through d25
• Fresenius-Kabi Agilia Partner Maintenance Software: through 3.3.0
• Fresenius-Kabi Link+ Agilia Firmware: before 3.0; 3.0, 3.0-d15 — fixed in 3.0
• Fresenius-Kabi Vigilant Centerium: 1.0
• Fresenius-Kabi Vigilant Insight: 1.0
• Fresenius-Kabi Vigilant Mastermed: 1.0

How to fix

Upgrade to a fixed version: Fresenius-Kabi Link+ Agilia Firmware 3.0. Check the vendor advisory for mitigations.

References

• https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
• https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

Get alerted when CVE-2021-33846 or the next vulnerability affects your stack