Security readout for executives and security teams
Plain-English summary
This issue exposes secrets stored in plaintext on a local host for Fresenius Kabi infusion-management software. Someone with physical access and low local privileges could impersonate users in the application. The main business concern is unauthorized access to clinical messaging workflows, not remote internet-scale compromise based on the supplied sources.
Executive priority
Treat this as a healthcare operational risk requiring asset confirmation and vendor-guided remediation. It is not described as remotely exploitable, but affected clinical systems with shared workstations, weak local access controls, or broad support access deserve prompt review.
Technical view
CVE-2021-23207 is CWE-256 plaintext password storage affecting Fresenius Kabi Vigilant Software Suite MasterMed Dashboard and Agilia Partner. The source states a local attacker can extract registry secrets, create valid JWTs for Vigilant MasterMed 2.0.1.3, impersonate users, and manipulate RabbitMQ queues and messages. CVSS 3.1 score is 6.5.
Likely exposure
Exposure is most likely in healthcare environments running the affected Fresenius Kabi Agilia Connect-related software on accessible workstations or servers. Risk depends heavily on physical access, local account privileges, and whether the affected MasterMed Dashboard or Agilia Partner components are deployed.
Exploitation context
The supplied data does not show CISA KEV listing or confirmed active exploitation. Exploitation requires local access with low privileges and no user interaction. The described impact is credential-derived impersonation and RabbitMQ message manipulation, but the sources do not provide public exploit status.
Researcher notes
The strongest evidence is the CVE description and CISA ICS medical advisory reference. Version scope is incomplete in the supplied affected list, while the description specifically names Vigilant MasterMed 2.0.1.3. Do not broaden affected products or versions without vendor confirmation.
Mitigation direction
- Check Fresenius Kabi and CISA guidance for approved updates or mitigations.
- Restrict physical and local account access to affected hosts.
- Limit administrative and registry access to authorized support personnel.
- Review RabbitMQ and application access controls for least privilege.
- Monitor for unusual JWT use or queue activity in affected environments.
Validation and detection
- Inventory Fresenius Kabi Vigilant MasterMed Dashboard and Agilia Partner deployments.
- Confirm whether Vigilant MasterMed version 2.0.1.3 is present.
- Review host access paths for physical and low-privilege local users.
- Assess whether application secrets are stored plaintext in registry locations.
- Check logs for unexplained user impersonation or RabbitMQ message activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-256: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCredential and access behavior lookup
The CVE wording references authentication or credential exposure, so valid-account and credential-access review may help. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-23207 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 6.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N24Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
6.5MediumVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.cisa.gov/uscert/ics/advisories/icsma-21-355-01CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Plaintext Storage of a Password
Plaintext Storage of a Password represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.