CVE-2021-41835

HIGH

Fresenius Kabi Agilia Link + < 3.0 - Cleartext Transmission of Sensitive Information

Title source: llm
STIX 2.1

Description

Fresenius Kabi Agilia Link + version 3.0 does not enforce transport layer encryption. Therefore, transmitted data may be sent in cleartext. Transport layer encryption is offered on Port TCP/443, but the affected service does not perform an automated redirect from the unencrypted service on Port TCP/80 to the encrypted service.

References (1)

Core 1
Core References
Third Party Advisory, US Government Resource x_refsource_misc
https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01

Scores

CVSS v3 7.3
EPSS 0.0031
EPSS Percentile 21.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-319 CWE-327
Status published
Products (7)
fresenius-kabi/agilia_connect < d25
fresenius-kabi/agilia_partner_maintenance_software < 3.3.0
fresenius-kabi/link\+_agilia_firmware 3.0 (2 CPE variants)
fresenius-kabi/link\+_agilia_firmware < 3.0
fresenius-kabi/vigilant_centerium 1.0
fresenius-kabi/vigilant_insight 1.0
fresenius-kabi/vigilant_mastermed 1.0
Published Jan 21, 2022
Tracked Since Feb 18, 2026