9.8

CVE-2021-23233

Fresenius Kabi Agilia Connect Infusion System 

Sensitive endpoints in Fresenius Kabi Agilia Link+ v3.0 and prior can be accessed without any authentication information such as the session cookie. An attacker can send requests to sensitive endpoints as an unauthenticated user to perform critical actions or modify critical configuration parameters.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Fresenius-kabi ≫ Link+ Agilia Firmware Version < 3.0
   Fresenius-kabi ≫ Link+ Agilia Version -
Fresenius-kabi ≫ Link+ Agilia Firmware Version 3.0 Update -
   Fresenius-kabi ≫ Link+ Agilia Version -
Fresenius-kabi ≫ Link+ Agilia Firmware Version 3.0 Update d15
   Fresenius-kabi ≫ Link+ Agilia Version -
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.95% 0.564
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
DHS.gov 7.3 3.9 3.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-284 Improper Access Control

The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

CWE-798 Use of Hard-coded Credentials

The product contains hard-coded credentials, such as a password or cryptographic key.

https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
Third Party Advisory
US Government Resource