Fresenius Kabi Agilia Connect Infusion System (Update A)

Risk Summary

Successful exploitation of these vulnerabilities in system accessories could allow an attacker to gain access to sensitive information, modify settings or parameters, or perform arbitrary actions as an authenticated user.

CVEs (13)

Remediations

• Fresenius Kabi has created new versions to address these vulnerabilities: Link+ v3.0 (D16 or later)
• Fresenius Kabi has created new versions to address these vulnerabilities: VSS v1.0.3 (or later)
• Fresenius Kabi has created new versions to address these vulnerabilities: Agilia Connect Pumps Wifi Module (D29 or later)
• Fresenius Kabi has created new versions to address these vulnerabilities: Agilia Connect Partner v3.3.2 (or later)
• Fresenius Kabi has initiated communication on this topic in April 2021 with users to inform them about availability of the new versions in corresponding countries. Contact Fresenius Kabi online or by phone at 1-800-333-6925 for more update information.
• Fresenius Kabi also identified that early Link+ devices (approximatively 1,200 devices) would need hardware change to support D16 or later firmware. Until those devices can be replaced in users’ installation, Fresenius Kabi recommends users to rely on CISA recommendations below.

Affected Vendors

Affected Products (3)

Affected Sectors

Healthcare and Public Health