CVE-2021-41835 Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algorithm
Attackers can intercept cleartext data because the infusion system fails to redirect unencrypted HTTP traffic to HTTPS.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-41835?
CVE-2021-41835 is a high-severity vulnerability in Fresenius Kabi Agilia Link+, published on 21 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect from the unencrypted service on Port TCP/80 to the encrypted service.
Which versions are affected by CVE-2021-41835?
It affects 6 products.
Products include Fresenius-Kabi Agilia Connect, Fresenius-Kabi Agilia Partner Maintenance Software, Fresenius-Kabi Link\+ Agilia Firmware, Fresenius-Kabi Vigilant Centerium, Fresenius-Kabi Vigilant Insight, Fresenius-Kabi Vigilant Mastermed.
How do I fix CVE-2021-41835?
No fix has been published for CVE-2021-41835 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-41835 being exploited?
There is no known exploitation of CVE-2021-41835 in the wild and no public exploit code.
Other vulnerabilities in Fresenius Kabi Agilia Link+
Sources
Also known as GHSA-42g4-xc42-5fr4.