CVE-2018-18565 — MEDIUM (6.8)

Q: How severe is CVE-2018-18565?

CVE-2018-18565 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2018-18565?

Check the references section above for vendor advisories and patch information. Affected products include: Roche Accu-Chek Inform Ii Firmware, Roche Accu-Chek Inform Ii, Roche Cobas H 232 Firmware, Roche Cobas H 232, Roche Coaguchek Pro Ii Firmware.

Vulnerability Description

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package.

CVSS Score

6.8

MEDIUM

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

CHANGED

Confidentiality

NONE

Integrity

HIGH

Availability

NONE

Affected Products

Vendor	Product	Versions
Roche	Accu-Chek Inform Ii Firmware	< 03.06.00
Roche	Accu-Chek Inform Ii	-
Roche	Cobas H 232 Firmware	< 03.01.03
Roche	Cobas H 232	-
Roche	Coaguchek Pro Ii Firmware	< 04.03.00
Roche	Coaguchek Pro Ii	-
Roche	Coaguchek Xs Plus Firmware	< 03.01.06
Roche	Coaguchek Xs Plus	-
Roche	Coaguchek Xs Pro Firmware	< 03.01.06
Roche	Coaguchek Xs Pro	-

Related Weaknesses (CWE)

CWE-434

References

http://www.securityfocus.com/bid/105843Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01MitigationThird Party AdvisoryUS Government Resource
http://www.securityfocus.com/bid/105843Third Party AdvisoryVDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01MitigationThird Party AdvisoryUS Government Resource

FAQ

What is CVE-2018-18565?

CVE-2018-18565 is a vulnerability with a CVSS score of 6.8 (MEDIUM). An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, Coag...

How severe is CVE-2018-18565?

CVE-2018-18565 has been rated MEDIUM with a CVSS base score of 6.8/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2018-18565?

Check the references section above for vendor advisories and patch information. Affected products include: Roche Accu-Chek Inform Ii Firmware, Roche Accu-Chek Inform Ii, Roche Cobas H 232 Firmware, Roche Cobas H 232, Roche Coaguchek Pro Ii Firmware.