CVE-2021-23233
📋 TL;DR
This vulnerability allows unauthenticated attackers to access sensitive endpoints in Fresenius Kabi Agilia Link+ medical infusion systems without any authentication. Attackers can perform critical actions or modify configuration parameters that should require authentication. This affects all Fresenius Kabi Agilia Link+ systems version 3.0 and earlier.
💻 Affected Systems
- Fresenius Kabi Agilia Link+
📦 What is this software?
Agilia Connect Firmware by Fresenius Kabi
Agilia Partner Maintenance Software by Fresenius Kabi
View all CVEs affecting Agilia Partner Maintenance Software →
Link\+ Agilia Firmware by Fresenius Kabi
Link\+ Agilia Firmware by Fresenius Kabi
Link\+ Agilia Firmware by Fresenius Kabi
Vigilant Centerium by Fresenius Kabi
Vigilant Insight by Fresenius Kabi
Vigilant Mastermed by Fresenius Kabi
⚠️ Risk & Real-World Impact
Worst Case
Unauthenticated attacker could modify drug library parameters, infusion settings, or device configurations leading to patient harm through incorrect medication delivery.
Likely Case
Unauthenticated attacker could disrupt infusion operations, modify system settings, or access sensitive patient and device data.
If Mitigated
With proper network segmentation and access controls, impact limited to unauthorized configuration changes within the segmented network zone.
🎯 Exploit Status
Direct HTTP requests to sensitive endpoints without authentication required. No special tools needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Contact Fresenius Kabi for updated version
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
Restart Required: Yes
Instructions:
1. Contact Fresenius Kabi for updated firmware. 2. Schedule maintenance window. 3. Backup configurations. 4. Apply firmware update. 5. Verify authentication is required for all sensitive endpoints.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Agilia Link+ systems on separate VLAN with strict firewall rules
Access Control Lists
allImplement strict network ACLs to limit access to Agilia Link+ systems
🧯 If You Can't Patch
- Implement strict network segmentation - isolate devices on medical device VLAN
- Deploy network monitoring and intrusion detection for unauthorized access attempts
🔍 How to Verify
Check if Vulnerable:
Attempt to access sensitive endpoints without authentication via HTTP requests. Check if endpoints like configuration or control interfaces respond without session cookie.Check Version:
Check device firmware version through device interface or contact Fresenius KabiVerify Fix Applied:
Verify that all sensitive endpoints now require proper authentication and reject unauthenticated requests.📡 Detection & Monitoring
Log Indicators:
- Unauthenticated access attempts to sensitive endpoints
- Configuration changes from unauthorized IPs
Network Indicators:
- HTTP requests to Agilia Link+ endpoints without authentication headers
- Unusual traffic patterns to medical device network segments
SIEM Query:
source_ip NOT IN authorized_medical_staff AND destination_port=80 AND destination_ip IN medical_device_range AND uri_path CONTAINS sensitive_endpoints