CVE-2021-43355 Fresenius Kabi Agilia Connect Infusion System use of client side authentication

High 7.3 Published 21 Jan 2022 Updated 16 Apr 2025

Attackers can bypass client-side validation to log in with service privileges in the Fresenius Kabi Vigilant Software Suite.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2021-43355?

CVE-2021-43355 is a high-severity authentication bypass vulnerability in Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard), published on 21 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 allows user input to be validated on the client side without authentication by the server. The server should not rely on the correctness of the data because users might not support or block JavaScript or intentionally bypass the client-side checks. An attacker with knowledge of the service user could circumvent the client-side control and login with service privileges.

Weakness: CWE-287, CWE-603

Which versions are affected by CVE-2021-43355?

It affects 6 products.

Products include Fresenius-Kabi Agilia Connect Firmware, Fresenius-Kabi Agilia Partner Maintenance Software, Fresenius-Kabi Link\+ Agilia Firmware, Fresenius-Kabi Vigilant Centerium, Fresenius-Kabi Vigilant Insight, Fresenius-Kabi Vigilant Mastermed.

How do I fix CVE-2021-43355?

No fix has been published for CVE-2021-43355 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2021-43355 being exploited?

There is no known exploitation of CVE-2021-43355 in the wild and no public exploit code.

Sources

Also known as GHSA-gc9x-xj3h-72v9.