User impersonation via registry-exposed JWT secrets
Published Jan 21, 2022 · Updated Apr 16, 2025
Credential exposure in Fresenius Kabi Vigilant Master Med before 2.0.1.3 and Agilia Partner before 3.0 allows local users to forge JWTs. Vigilant Master Med stores JWT-signing secrets in the Windows registry without sufficient protection, allowing extracted values to sign valid tokens for arbitrary identities. Physical access to the host is required; forged identities can alter RabbitMQ queues and messages, while the public record does not explain Agilia Partner's vulnerable locus.
Summary
What happened
Credential exposure in Fresenius Kabi Vigilant Master Med before 2.0.1.3 and Agilia Partner before 3.0 allows local users to forge JWTs. Vigilant Master Med stores JWT-signing secrets in the Windows registry without sufficient protection, allowing extracted values to sign valid tokens for arbitrary identities. Physical access to the host is required; forged identities can alter RabbitMQ queues and messages, while the public record does not explain Agilia Partner's vulnerable locus.
The record
- CVE
- CVE-2021-23207
- Published
- Jan 21, 2022
- Updated
- Apr 16, 2025
- Vendor
- Fresenius Kabi
- Product
- Vigilant Master Med
- Classifications
- CWE-256, CWE-522, T1552.002, T1606
- Attack vector
- physical
- Privileges
- Unavailable
Timeline
How it unfolded
- Jan 21, 2022CVE publishedPublication date reported by the CVE source.
- Apr 16, 2025Record updatedLatest update available in the CVE record.
Exploitability
Present is not the same as exploitable
Compare your product and version with the public record. A matching version still requires validation against your environment.
Is a vulnerable build present?
Compare these published version ranges with your installed build and any vendor patches.
- Affected versionversion=unspecified <2.0.1.3
What conditions does exploitation require?
What is affected?
Attacks
What attackers are doing with it
Daily unique IPs observed by Shadowserver honeypots for known exploited vulnerabilities (KEVs). Missing observations do not establish an absence of attacks.
Weakness, pattern, technique
Public exploit references
No public exploit references are available in this record.
Labels summarize the accepted research assessment. They do not indicate a test against your environment.
Technologies
Your stack
See the directory against your own environment.
Your stack
Check the software in your environment
Book a demo to see how Hinoki identifies affected software and validates exploitability in your environment.
Book a demo