Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2021-23195— Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing

Quick assessment

Affected

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard)

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Fresenius Kabi Agilia Connect Infusion System是德国Fresenius Kabi公司的一个输液系统。 Fresenius Kabi Agilia Connect Infusion System存在安全漏洞，该漏洞源于Vigilant API有激活自动索引(目录列表)的选项。当访问一个目录时，web服务器以HTML的形式传递它的全部内容。如果索引文件不存在，并且启用了目录列表功能，则会显示目录的所有内容，使攻击者可利用该漏洞能够识别并访问服务器上的文件。

CVSS 5.3 · Medium EPSS 0.84% · P58 Updated Apr 17, 2025

Possible ATT&CK Techniques 1 AI

T1083 · File and Directory Discovery

Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-23195

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Fresenius Kabi Agilia Connect Infusion System exposure of information through directory listing

Source: CVE Program / CVE List V5

Vulnerability Description

Fresenius Kabi Vigilant Software Suite (Mastermed Dashboard) version 2.0.1.3 has the option for automated indexing (directory listing) activated. When accessing a directory, a web server delivers its entire content in HTML form. If an index file does not exist and directory listing is enabled, all content of the directory will be displayed, allowing an attacker to identify and access files on the server.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

通过目录枚举导致的信息暴露

Source: CVE Program / CVE List V5

Vulnerability Title

Fresenius Kabi Agilia Connect Infusion System 信息泄露漏洞

Source: CNNVD (China National Vulnerability Database)

Vulnerability Description

Source: CNNVD (China National Vulnerability Database)

CVSS Information

N/A

Source: CNNVD (China National Vulnerability Database)

Vulnerability Type

N/A

Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Fresenius Kabi	Vigilant Software Suite (Mastermed Dashboard)	unspecified ~ 2.0.1.3	-

II. Public POCs for CVE-2021-23195

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2021-23195

请登录查看更多情报信息。

Vendor Advisories for CVE-2021-23195 (1)

https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2021-23195

Same Patch Batch · Fresenius Kabi · 2022-01-21 · 12 CVEs total

CVE-2021-23236	7.5 HIGH	Fresenius Kabi Agilia Connect Infusion System uncontrolled resource consumption
CVE-2021-23196	7.3 HIGH	Fresenius Kabi Agilia Connect Infusion System insufficiently protected credentials
CVE-2021-23233	7.3 HIGH	Fresenius Kabi Agilia Connect Infusion System
CVE-2021-41835	7.3 HIGH	Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algor
CVE-2021-43355	7.3 HIGH	Fresenius Kabi Agilia Connect Infusion System use of client side authentication
CVE-2021-23207	6.5 MEDIUM	Fresenius Kabi Agilia Connect Infusion System plaintext storage of a password
CVE-2021-31562	6.5 MEDIUM	Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algor
CVE-2021-44464	6.3 MEDIUM	Fresenius Kabi Agilia Connect Infusion System hard coded credentials
CVE-2021-33846	5.9 MEDIUM	Fresenius Kabi Agilia Connect Infusion System use of a broken or risky cryptographic algor
CVE-2021-33848	5.4 MEDIUM	Fresenius Kabi Agilia Connect Infusion System cross site scripting
CVE-2021-33843	5.3 MEDIUM	Fresenius Kabi Agilia Connect Infusion System files or directories accessible to external

IV. Related Vulnerabilities

Same product: Vigilant Software Suite (Mastermed Dashboard)

Same vendor: Fresenius Kabi

Same weakness: CWE-548