CVE-2021-23207
5.5
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability: 1.8 / Impact: 3.6
Source: NVD
Description
An attacker with physical access to the host can extract the secrets from the registry and create valid JWT tokens for the Fresenius Kabi Vigilant MasterMed version 2.0.1.3 application and impersonate arbitrary users. An attacker could manipulate RabbitMQ queues and messages by impersonating users.
Affected (8)
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to d25 |
| Running on/with | Platform Versions |
|---|---|
Fresenius Kabi Agilia Connect | All versions |
Configuration B
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 3.3.0 | |
| Version 1.0 | |
| Version 1.0 | |
| Version 1.0 |
Configuration C
| Vulnerable Software | Affected Versions |
|---|---|
| Before 3.0 |
| Running on/with | Platform Versions |
|---|---|
Fresenius Kabi Link+ Agilia | All versions |
Related CWEs
CWE-256
Plaintext Storage of a Password
Storing a password in plaintext may result in a system compromise.
CWE-522
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
References (2)
Source: ics-cert@hq.dhs.gov
Third Party AdvisoryUS Government Resource
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party AdvisoryUS Government Resource
Timeline
No history available yet.