CVE-2021-43355
📋 TL;DR
This vulnerability allows attackers to bypass client-side authentication controls in Fresenius Kabi Vigilant Software Suite, potentially gaining unauthorized access with service privileges. It affects healthcare organizations using the Mastermed Dashboard version 2.0.1.3 for medical device monitoring.
💻 Affected Systems
- Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)
📦 What is this software?
Agilia Connect Firmware by Fresenius Kabi
Agilia Partner Maintenance Software by Fresenius Kabi
View all CVEs affecting Agilia Partner Maintenance Software →
Link\+ Agilia Firmware by Fresenius Kabi
Link\+ Agilia Firmware by Fresenius Kabi
Link\+ Agilia Firmware by Fresenius Kabi
Vigilant Centerium by Fresenius Kabi
Vigilant Insight by Fresenius Kabi
Vigilant Mastermed by Fresenius Kabi
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain service-level access to medical device monitoring systems, potentially manipulating medical device data or disrupting critical healthcare operations.
Likely Case
Unauthorized access to medical device monitoring dashboards, allowing viewing of sensitive patient data and device status information.
If Mitigated
No impact if proper server-side authentication is implemented and client-side validation is not trusted.
🎯 Exploit Status
Requires knowledge of service user credentials but bypasses client-side validation checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.0.2.0 or later
Vendor Advisory: https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01
Restart Required: Yes
Instructions:
1. Contact Fresenius Kabi for updated version 2.0.2.0 or later. 2. Backup current configuration. 3. Install the updated software. 4. Restart the system. 5. Verify authentication now requires server-side validation.
🔧 Temporary Workarounds
Implement Network Segmentation
allIsolate the Mastermed Dashboard system from untrusted networks and restrict access to authorized users only.
Enable Server-Side Authentication
windowsConfigure the system to perform authentication validation on the server side rather than relying on client-side checks.
🧯 If You Can't Patch
- Implement strict network access controls to limit who can reach the vulnerable system
- Monitor authentication logs for unusual login attempts or service account usage
🔍 How to Verify
Check if Vulnerable:
Check software version in application settings or About dialog. If version is 2.0.1.3, system is vulnerable.Check Version:
Check application interface for version information or consult system documentationVerify Fix Applied:
After update, verify version is 2.0.2.0 or later and test that client-side manipulation of authentication data is rejected by server.📡 Detection & Monitoring
Log Indicators:
- Multiple failed authentication attempts followed by successful login with service account
- Authentication events without proper server-side validation
Network Indicators:
- Unusual authentication traffic patterns
- Requests bypassing client-side validation mechanisms
SIEM Query:
source="mastermed" AND (event_type="authentication" AND (status="success" AND client_validation="bypassed"))