6.5

CVE-2021-23207

Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password

An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating users.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fresenius-kabi ≫ Agilia Connect Version <= d25
   Fresenius-kabi ≫ Agilia Connect Version-
Fresenius-kabi ≫ Link+ Agilia Firmware Version < 3.0
   Fresenius-kabi ≫ Link+ Agilia Version-
Fresenius-kabi ≫ Link+ Agilia Firmware Version3.0 Update-
   Fresenius-kabi ≫ Link+ Agilia Version-
Fresenius-kabi ≫ Link+ Agilia Firmware Version3.0 Updated15
   Fresenius-kabi ≫ Link+ Agilia Version-
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.12
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 5.5 1.8 3.6
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST 2.1 3.9 2.9
AV:L/AC:L/Au:N/C:P/I:N/A:N
DHS.gov 6.5 2 4
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CWE-256 Plaintext Storage of a Password

The product stores a password in plaintext within resources such as memory or files.

CWE-522 Insufficiently Protected Credentials

The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
Third Party Advisory
US Government Resource