ID CVE-2018-18562
Summary An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface.
References
Vulnerable Configurations
  • cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*
    cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*
  • cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*
    cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*
  • cpe:2.3:o:roche:coaguchek_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:roche:coaguchek_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:roche:coaguchek:-:*:*:*:*:*:*:*
    cpe:2.3:h:roche:coaguchek:-:*:*:*:*:*:*:*
  • cpe:2.3:o:roche:base_unit_hub_firmware:*:*:*:*:*:*:*:*
    cpe:2.3:o:roche:base_unit_hub_firmware:*:*:*:*:*:*:*:*
  • cpe:2.3:h:roche:base_unit_hub:-:*:*:*:*:*:*:*
    cpe:2.3:h:roche:base_unit_hub:-:*:*:*:*:*:*:*
CVSS
Base: 3.3 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:
CWE CWE-521
CAPEC
  • Try Common or Default Usernames and Passwords
    An adversary may try certain common or default usernames and passwords to gain access into the system and perform unauthorized actions. An adversary may try an intelligent brute force using empty passwords, known vendor default credentials, as well as a dictionary of common usernames and passwords. Many vendor products come preconfigured with default (and thus well-known) usernames and passwords that should be deleted prior to usage in a production environment. It is a common mistake to forget to remove these default login credentials. Another problem is that users would pick very simple (common) passwords (e.g. "secret" or "password") that make it easier for the attacker to gain access to the system compared to using a brute force attack or even a dictionary attack using a full dictionary.
  • Brute Force
    In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset. Examples of secrets can include, but are not limited to, passwords, encryption keys, database lookup keys, and initial values to one-way functions. The key factor in this attack is the attackers' ability to explore the possible secret space rapidly. This, in turn, is a function of the size of the secret space and the computational power the attacker is able to bring to bear on the problem. If the attacker has modest resources and the secret space is large, the challenge facing the attacker is intractable. While the defender cannot control the resources available to an attacker, they can control the size of the secret space. Creating a large secret space involves selecting one's secret from as large a field of equally likely alternative secrets as possible and ensuring that an attacker is unable to reduce the size of this field using available clues or cryptanalysis. Doing this is more difficult than it sounds since elimination of patterns (which, in turn, would provide an attacker clues that would help them reduce the space of potential secrets) is difficult to do using deterministic machines, such as computers. Assuming a finite secret space, a brute force attack will eventually succeed. The defender must rely on making sure that the time and resources necessary to do so will exceed the value of the information. For example, a secret space that will likely take hundreds of years to explore is likely safe from raw-brute force attacks.
  • Password Brute Forcing
    In this attack, the adversary tries every possible value for a password until they succeed. A brute force attack, if feasible computationally, will always be successful because it will essentially go through all possible passwords given the alphabet used (lower case letters, upper case letters, numbers, symbols, etc.) and the maximum length of the password. A system will be particularly vulnerable to this type of an attack if it does not have a proper enforcement mechanism in place to ensure that passwords selected by users are strong passwords that comply with an adequate password policy. In practice a pure brute force attack on passwords is rarely used, unless the password is suspected to be weak. Other password cracking methods exist that are far more effective (e.g. dictionary attacks, rainbow tables, etc.). Knowing the password policy on the system can make a brute force attack more efficient. For instance, if the policy states that all passwords must be of a certain level, there is no need to check smaller candidates.
  • Rainbow Table Password Cracking
    An attacker gets access to the database table where hashes of passwords are stored. He then uses a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system. A password rainbow table stores hash chains for various passwords. A password chain is computed, starting from the original password, P, via a reduce(compression) function R and a hash function H. A recurrence relation exists where Xi+1 = R(H(Xi)), X0 = P. Then the hash chain of length n for the original password P can be formed: X1, X2, X3, ... , Xn-2, Xn-1, Xn, H(Xn). P and H(Xn) are then stored together in the rainbow table. Constructing the rainbow tables takes a very long time and is computationally expensive. A separate table needs to be constructed for the various hash algorithms (e.g. SHA1, MD5, etc.). However, once a rainbow table is computed, it can be very effective in cracking the passwords that have been hashed without the use of salt.
  • Dictionary-based Password Attack
    An attacker tries each of the words in a dictionary as passwords to gain access to the system via some user's account. If the password chosen by the user was a word within the dictionary, this attack will be successful (in the absence of other mitigations). This is a specific instance of the password brute forcing attack pattern.
Access
VectorComplexityAuthentication
ADJACENT_NETWORK LOW NONE
Impact
ConfidentialityIntegrityAvailability
PARTIAL NONE NONE
cvss-vector via4 AV:A/AC:L/Au:N/C:P/I:N/A:N
refmap via4
bid 105843
misc https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01
Last major update 03-10-2019 - 00:03
Published 20-11-2018 - 19:29
Last modified 03-10-2019 - 00:03
Back to Top