Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
5 vulnerabilities by roche
VAR-201811-0062
Vulnerability from variot - Updated: 2023-12-18 12:43An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package. plural Roche The product contains a vulnerability related to unlimited uploads of dangerous types of files.Information may be tampered with. RocheAccu-ChekInformIIInstrument and others are hand-held blood test medical devices from Roche, Switzerland. Permissions and access control vulnerabilities exist in several Roche devices that an attacker can use to change configurations. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities: 1. An authentication bypass vulnerability 2. An OS command-injection vulnerability 3. An arbitrary file-upload vulnerability 4. A remote code-execution vulnerability 5. An access bypass vulnerability An attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0062",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "coaguchek pro ii",
"scope": "lt",
"trust": 1.6,
"vendor": "roche",
"version": "04.03.00"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.04"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.03"
},
{
"model": "coaguchek xs plus",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.06"
},
{
"model": "cobas h 232",
"scope": "gte",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.06.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "04.03.00"
},
{
"model": "accu-chek inform ii",
"scope": "gte",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.00"
},
{
"model": "coaguchek xs pro",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.06"
},
{
"model": "accu-chek inform ii",
"scope": "eq",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "04.03.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "of 04.x"
},
{
"model": "accu-chek inform ii instrument",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.06.00"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.6,
"vendor": "roche",
"version": "232\u003c03.01.03"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.6,
"vendor": "roche",
"version": "232\u003c04.00.04"
},
{
"model": "coaguchek xs plus and pro",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.01.06"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "accu chek inform ii",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "cobas h 232",
"version": "*"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "2320"
},
{
"model": "coaguchek xs pro",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek xs plus",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek pro ii",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "accu-chek inform ii instrument",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2324.0.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.3"
},
{
"model": "coaguchek xs pro",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek xs plus",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek pro ii",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "4.3"
},
{
"model": "coaguchek",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.4"
},
{
"model": "accu-chek inform ii instrument",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek pro ii",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek xs plus",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek xs pro",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "NVD",
"id": "CVE-2018-18565"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.03.00",
"versionStartIncluding": "04.00.00",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.06.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.00.04",
"versionStartIncluding": "04.00.00",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.03",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_pro_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.03.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_pro_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_xs_plus_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.06",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_xs_plus:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_xs_pro_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.06",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_xs_pro:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18565"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Niv Yehezkel of Medigate",
"sources": [
{
"db": "BID",
"id": "105843"
}
],
"trust": 0.3
},
"cve": "CVE-2018-18565",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "PARTIAL",
"baseScore": 4.1,
"confidentialityImpact": "NONE",
"exploitabilityScore": 5.1,
"impactScore": 4.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Partial",
"baseScore": 4.1,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-18565",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Medium",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:S/C:N/I:P/A:P",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "CNVD-2018-25430",
"impactScore": 9.5,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:P/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.5,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1",
"impactScore": 9.5,
"integrityImpact": "PARTIAL",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:P/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.3,
"impactScore": 4.0,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.8,
"baseSeverity": "Medium",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-18565",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-18565",
"trust": 1.8,
"value": "MEDIUM"
},
{
"author": "CNVD",
"id": "CNVD-2018-25430",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201811-118",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1",
"trust": 0.2,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package. plural Roche The product contains a vulnerability related to unlimited uploads of dangerous types of files.Information may be tampered with. RocheAccu-ChekInformIIInstrument and others are hand-held blood test medical devices from Roche, Switzerland. Permissions and access control vulnerabilities exist in several Roche devices that an attacker can use to change configurations. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities:\n1. An authentication bypass vulnerability\n2. An OS command-injection vulnerability\n3. An arbitrary file-upload vulnerability\n4. A remote code-execution vulnerability\n5. An access bypass vulnerability\nAn attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18565",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-310-01",
"trust": 3.3
},
{
"db": "BID",
"id": "105843",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2018-25430",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201811-118",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D80FC80-463F-11E9-86D0-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"id": "VAR-201811-0062",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
}
],
"trust": 1.5857142883333335
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
}
]
},
"last_update_date": "2023-12-18T12:43:46.142000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://diagnostics.roche.com/us/en/home.html"
},
{
"title": "Patches for Multiple Roche Device Permissions and Access Control Vulnerabilities (CNVD-2018-25430)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/147341"
},
{
"title": "Multiple Roche Fixing measures for device permission permission and access control problems",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=123185"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-434",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "NVD",
"id": "CVE-2018-18565"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-310-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/105843"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18565"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18565"
},
{
"trust": 0.3,
"url": "https://www.roche.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "IVD",
"id": "7d80fc80-463f-11e9-86d0-000c29342cb1"
},
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"date": "2018-11-20T19:29:00.963000",
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"date": "2018-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25430"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012882"
},
{
"date": "2018-12-28T14:17:14.250000",
"db": "NVD",
"id": "CVE-2018-18565"
},
{
"date": "2020-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "specific network environment",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Roche Product unrestricted upload vulnerability",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012882"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "permissions and access control issues",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-118"
}
],
"trust": 0.6
}
}
VAR-201811-0059
Vulnerability from variot - Updated: 2023-12-18 12:43An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface. plural Roche The product contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. RocheAccu-ChekInformIIBaseUnit/BaseUnitHub and CoaguChek/cobash232HandheldBaseUnit are hand-held blood test medical devices from Roche, Switzerland. An authorization issue vulnerability exists in versions prior to RocheAccu-ChekInformIIBaseUnit/BaseUnitHub03.01.04 and prior to CoaguChek/cobash232HandheldBaseUnit03.01.04. An attacker could exploit this vulnerability to execute arbitrary commands on the operating system. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities: 1. An authentication bypass vulnerability 2. An OS command-injection vulnerability 3. An arbitrary file-upload vulnerability 4. A remote code-execution vulnerability 5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0059",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "coaguchek",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "base unit hub",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "base unit hub",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "coaguchek",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "accu-chek inform ii base unit/base unit hub",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "coaguchek/cobas h232 handheld base unit",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "2320"
},
{
"model": "coaguchek xs pro",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek xs plus",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek pro ii",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "accu-chek inform ii instrument",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2324.0.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.3"
},
{
"model": "coaguchek xs pro",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek xs plus",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek pro ii",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "4.3"
},
{
"model": "coaguchek",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.4"
},
{
"model": "accu-chek inform ii instrument",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "accu chek inform ii",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "cobas h 232",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "base unit hub",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "NVD",
"id": "CVE-2018-18562"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:base_unit_hub_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:base_unit_hub:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18562"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Niv Yehezkel of Medigate",
"sources": [
{
"db": "BID",
"id": "105843"
}
],
"trust": 0.3
},
"cve": "CVE-2018-18562",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"impactScore": 2.9,
"integrityImpact": "NONE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 3.3,
"confidentialityImpact": "Partial",
"exploitabilityScore": null,
"id": "CVE-2018-18562",
"impactScore": null,
"integrityImpact": "None",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "CNVD-2019-08983",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 6.5,
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.2,
"vectorString": "AV:A/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.8,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-18562",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-18562",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2019-08983",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201811-115",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Weak access credentials may enable attackers in the adjacent network to gain unauthorized service access via a service interface. plural Roche The product contains vulnerabilities related to certificate and password management.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. RocheAccu-ChekInformIIBaseUnit/BaseUnitHub and CoaguChek/cobash232HandheldBaseUnit are hand-held blood test medical devices from Roche, Switzerland. An authorization issue vulnerability exists in versions prior to RocheAccu-ChekInformIIBaseUnit/BaseUnitHub03.01.04 and prior to CoaguChek/cobash232HandheldBaseUnit03.01.04. An attacker could exploit this vulnerability to execute arbitrary commands on the operating system. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities:\n1. An authentication bypass vulnerability\n2. An OS command-injection vulnerability\n3. An arbitrary file-upload vulnerability\n4. A remote code-execution vulnerability\n5",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18562",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-310-01",
"trust": 3.3
},
{
"db": "BID",
"id": "105843",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2019-08983",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201811-115",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879",
"trust": 0.8
},
{
"db": "IVD",
"id": "388AC3A5-5C09-40C4-9636-9F7B015CEB2E",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"id": "VAR-201811-0059",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
}
],
"trust": 1.6163265328571428
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
}
]
},
"last_update_date": "2023-12-18T12:43:46.102000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://diagnostics.roche.com/us/en/home.html"
},
{
"title": "Roche Accu-Chek Inform II Base Unit/Base Unit Hub and CoaguChek/cobas h232 Handheld Base Unit Remediation measures for authorization problem vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=100317"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-521",
"trust": 1.0
},
{
"problemtype": "CWE-255",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "NVD",
"id": "CVE-2018-18562"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-310-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/105843"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18562"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18562"
},
{
"trust": 0.3,
"url": "https://www.roche.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-04-03T00:00:00",
"db": "IVD",
"id": "388ac3a5-5c09-40c4-9636-9f7b015ceb2e"
},
{
"date": "2019-04-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"date": "2018-11-20T19:29:00.793000",
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"date": "2018-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2019-04-03T00:00:00",
"db": "CNVD",
"id": "CNVD-2019-08983"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012879"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2018-18562"
},
{
"date": "2019-10-23T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Roche Vulnerabilities related to certificate and password management in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012879"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "trust management problem",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-115"
}
],
"trust": 0.6
}
}
VAR-201811-0058
Vulnerability from variot - Updated: 2023-12-18 12:43An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system. plural Roche The product contains authentication vulnerabilities.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. RocheAccu-ChekInformIIBaseUnit/BaseUnitHub and CoaguChek/cobash232HandheldBaseUnit are hand-held blood test medical devices from Roche, Switzerland. A security vulnerability exists in versions prior to RocheAccu-ChekInformIIBaseUnit/BaseUnitHub03.01.04 and in versions prior to CoaguChek/cobash232HandheldBaseUnit03.01.04. The vulnerability stems from the failure of the program to assign security. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities: 1. An authentication bypass vulnerability 2. An OS command-injection vulnerability 3. An arbitrary file-upload vulnerability 4. A remote code-execution vulnerability 5
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0058",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "coaguchek",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "base unit hub",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "base unit hub",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "coaguchek",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "03.01.04"
},
{
"model": "accu-chek inform ii base unit/base unit hub",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "coaguchek/cobas h232 handheld base unit",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.01.04"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "2320"
},
{
"model": "coaguchek xs pro",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek xs plus",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek pro ii",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "accu-chek inform ii instrument",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2324.0.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.3"
},
{
"model": "coaguchek xs pro",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek xs plus",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek pro ii",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "4.3"
},
{
"model": "coaguchek",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.4"
},
{
"model": "accu-chek inform ii instrument",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "accu chek inform ii",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "cobas h 232",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "base unit hub",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "NVD",
"id": "CVE-2018-18561"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:base_unit_hub_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:base_unit_hub:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18561"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Niv Yehezkel of Medigate",
"sources": [
{
"db": "BID",
"id": "105843"
}
],
"trust": 0.3
},
"cve": "CVE-2018-18561",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 7.7,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 5.1,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "Single",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 7.7,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2018-18561",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:S/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "CNVD-2018-25294",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"id": "7d806042-463f-11e9-9ab2-000c29342cb1",
"impactScore": 6.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 8.0,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.1,
"impactScore": 5.9,
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 8.0,
"baseSeverity": "High",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-18561",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "Low",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-18561",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-25294",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201811-114",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system. plural Roche The product contains authentication vulnerabilities.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. RocheAccu-ChekInformIIBaseUnit/BaseUnitHub and CoaguChek/cobash232HandheldBaseUnit are hand-held blood test medical devices from Roche, Switzerland. A security vulnerability exists in versions prior to RocheAccu-ChekInformIIBaseUnit/BaseUnitHub03.01.04 and in versions prior to CoaguChek/cobash232HandheldBaseUnit03.01.04. The vulnerability stems from the failure of the program to assign security. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities:\n1. An authentication bypass vulnerability\n2. An OS command-injection vulnerability\n3. An arbitrary file-upload vulnerability\n4. A remote code-execution vulnerability\n5",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18561",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-310-01",
"trust": 3.3
},
{
"db": "BID",
"id": "105843",
"trust": 2.5
},
{
"db": "CNVD",
"id": "CNVD-2018-25294",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201811-114",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D806042-463F-11E9-9AB2-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"id": "VAR-201811-0058",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
}
],
"trust": 1.6163265328571428
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
}
]
},
"last_update_date": "2023-12-18T12:43:46.063000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://diagnostics.roche.com/us/en/home.html"
},
{
"title": "Roche Accu-Chek Inform II Base Unit/Base Unit Hub and CoaguChek/cobas h232 Handheld Base Unit Security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=126829"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-732",
"trust": 1.0
},
{
"problemtype": "CWE-287",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "NVD",
"id": "CVE-2018-18561"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-310-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/105843"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18561"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18561"
},
{
"trust": 0.3,
"url": "https://www.roche.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "IVD",
"id": "7d806042-463f-11e9-9ab2-000c29342cb1"
},
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"date": "2018-11-20T19:29:00.713000",
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"date": "2018-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25294"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012878"
},
{
"date": "2020-08-24T17:37:01.140000",
"db": "NVD",
"id": "CVE-2018-18561"
},
{
"date": "2020-10-22T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Roche Authentication vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012878"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "authorization issue",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-114"
}
],
"trust": 0.6
}
}
VAR-201811-0061
Vulnerability from variot - Updated: 2023-12-18 12:43An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration. RocheAccu-ChekInformIIInstrument, CoaguChekProII and cobash232 are all hand-held blood testing medical devices from Roche, Switzerland. Permissions and access control vulnerabilities exist in multiple Roche devices, which can be exploited by an attacker to create arbitrary code on the system through specially crafted messages. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities: 1. An authentication bypass vulnerability 2. An OS command-injection vulnerability 3. An arbitrary file-upload vulnerability 4. A remote code-execution vulnerability 5. An access bypass vulnerability An attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0061",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "coaguchek pro ii",
"scope": "lt",
"trust": 1.6,
"vendor": "roche",
"version": "04.03.00"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.04"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.06.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "04.03.00"
},
{
"model": "accu-chek inform ii",
"scope": "gte",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.00"
},
{
"model": "accu-chek inform ii",
"scope": "eq",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "04.03.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "of 04.x"
},
{
"model": "accu-chek inform ii instrument",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.06.00"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.6,
"vendor": "roche",
"version": "232\u003c04.00.04"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "accu chek inform ii",
"version": "*"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "2320"
},
{
"model": "coaguchek xs pro",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek xs plus",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek pro ii",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "accu-chek inform ii instrument",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2324.0.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.3"
},
{
"model": "coaguchek xs pro",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek xs plus",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek pro ii",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "4.3"
},
{
"model": "coaguchek",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.4"
},
{
"model": "accu-chek inform ii instrument",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "cobas h 232",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek pro ii",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "NVD",
"id": "CVE-2018-18564"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.03.00",
"versionStartIncluding": "04.00.00",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.06.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.00.04",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_pro_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.03.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_pro_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18564"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Niv Yehezkel of Medigate",
"sources": [
{
"db": "BID",
"id": "105843"
}
],
"trust": 0.3
},
"cve": "CVE-2018-18564",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 3.3,
"confidentialityImpact": "NONE",
"exploitabilityScore": 6.5,
"impactScore": 2.9,
"integrityImpact": "PARTIAL",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "LOW",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 3.3,
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-18564",
"impactScore": null,
"integrityImpact": "Partial",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "Low",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "CNVD-2018-25431",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 6.8,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 3.2,
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1",
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:H/Au:N/C:C/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.8,
"impactScore": 4.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 7.4,
"baseSeverity": "High",
"confidentialityImpact": "None",
"exploitabilityScore": null,
"id": "CVE-2018-18564",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-18564",
"trust": 1.8,
"value": "HIGH"
},
{
"author": "CNVD",
"id": "CNVD-2018-25431",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201811-117",
"trust": 0.6,
"value": "HIGH"
},
{
"author": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1",
"trust": 0.2,
"value": "HIGH"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration. RocheAccu-ChekInformIIInstrument, CoaguChekProII and cobash232 are all hand-held blood testing medical devices from Roche, Switzerland. Permissions and access control vulnerabilities exist in multiple Roche devices, which can be exploited by an attacker to create arbitrary code on the system through specially crafted messages. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities:\n1. An authentication bypass vulnerability\n2. An OS command-injection vulnerability\n3. An arbitrary file-upload vulnerability\n4. A remote code-execution vulnerability\n5. An access bypass vulnerability\nAn attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18564",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-310-01",
"trust": 3.3
},
{
"db": "BID",
"id": "105843",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2018-25431",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D80D56E-463F-11E9-9D04-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"id": "VAR-201811-0061",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
}
],
"trust": 1.542857146
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
}
]
},
"last_update_date": "2023-12-18T12:43:46.029000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://diagnostics.roche.com/us/en/home.html"
},
{
"title": "Patches for Multiple Roche Device Permissions and Access Control Vulnerabilities (CNVD-2018-25431)",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/147333"
},
{
"title": "Multiple Roche Fixes for device permissions and access control vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=100319"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-noinfo",
"trust": 1.0
},
{
"problemtype": "CWE-284",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "NVD",
"id": "CVE-2018-18564"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-310-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/105843"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18564"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18564"
},
{
"trust": 0.3,
"url": "https://www.roche.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"date": "2018-11-20T19:29:00.900000",
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"date": "2018-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25431"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012881"
},
{
"date": "2020-08-24T17:37:01.140000",
"db": "NVD",
"id": "CVE-2018-18564"
},
{
"date": "2020-08-25T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Roche Access control vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012881"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Access control error",
"sources": [
{
"db": "IVD",
"id": "7d80d56e-463f-11e9-9d04-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-117"
}
],
"trust": 0.8
}
}
VAR-201811-0060
Vulnerability from variot - Updated: 2023-12-18 12:43An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial Number below KQ0400000 or KS0400000) and cobas h 232 before 04.00.04 (Serial Number above KQ0400000 or KS0400000). Improper access control to a service command allows attackers in the adjacent network to execute arbitrary code on the system through a crafted Poct1-A message. plural Roche The product contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. RocheAccu-ChekInformIIInstrument and others are hand-held blood test medical devices from Roche, Switzerland. There are device permission and access control vulnerabilities in the software update mechanism of several Roche devices. The vulnerability stems from the failure of the program to perform proper access control. The attacker can use the special update package to write the file to any file. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities: 1. An authentication bypass vulnerability 2. An OS command-injection vulnerability 3. An arbitrary file-upload vulnerability 4. A remote code-execution vulnerability 5. An access bypass vulnerability An attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201811-0060",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "coaguchek pro ii",
"scope": "lt",
"trust": 1.6,
"vendor": "roche",
"version": "04.03.00"
},
{
"model": "coaguchek xs plus",
"scope": "lt",
"trust": 1.6,
"vendor": "roche",
"version": "03.01.06"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.04"
},
{
"model": "cobas h 232",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.03"
},
{
"model": "cobas h 232",
"scope": "gte",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.06.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "04.03.00"
},
{
"model": "accu-chek inform ii",
"scope": "gte",
"trust": 1.0,
"vendor": "roche",
"version": "04.00.00"
},
{
"model": "coaguchek xs pro",
"scope": "lt",
"trust": 1.0,
"vendor": "roche",
"version": "03.01.06"
},
{
"model": "accu-chek inform ii",
"scope": "eq",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "04.03.00"
},
{
"model": "accu-chek inform ii",
"scope": "lt",
"trust": 0.8,
"vendor": "roche diagnostics",
"version": "of 04.x"
},
{
"model": "accu-chek inform ii instrument",
"scope": "lt",
"trust": 0.6,
"vendor": "roche",
"version": "03.06.00"
},
{
"model": "coaguchek xs pro",
"scope": null,
"trust": 0.6,
"vendor": "roche",
"version": null
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.6,
"vendor": "roche",
"version": "232\u003c03.01.03"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.6,
"vendor": "roche",
"version": "232\u003c04.00.04"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "accu chek inform ii",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.4,
"vendor": "cobas h 232",
"version": "*"
},
{
"model": "cobas h",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "2320"
},
{
"model": "coaguchek xs pro",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek xs plus",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek pro ii",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "coaguchek",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "accu-chek inform ii instrument",
"scope": "eq",
"trust": 0.3,
"vendor": "roche",
"version": "0"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2324.0.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.4"
},
{
"model": "cobas h",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "2323.1.3"
},
{
"model": "coaguchek xs pro",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek xs plus",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.6"
},
{
"model": "coaguchek pro ii",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "4.3"
},
{
"model": "coaguchek",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.1.4"
},
{
"model": "accu-chek inform ii instrument",
"scope": "ne",
"trust": 0.3,
"vendor": "roche",
"version": "3.6"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek pro ii",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek xs plus",
"version": "*"
},
{
"model": null,
"scope": "eq",
"trust": 0.2,
"vendor": "coaguchek xs pro",
"version": "*"
}
],
"sources": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "NVD",
"id": "CVE-2018-18563"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.03.00",
"versionStartIncluding": "04.00.00",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.06.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.03",
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.00.04",
"versionStartIncluding": "04.00.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_pro_ii_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "04.03.00",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_pro_ii:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_xs_plus_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.06",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_xs_plus:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
},
{
"children": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:roche:coaguchek_xs_pro_firmware:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndExcluding": "03.01.06",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:h:roche:coaguchek_xs_pro:-:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": false
}
],
"operator": "OR"
}
],
"cpe_match": [],
"operator": "AND"
}
]
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18563"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Niv Yehezkel of Medigate",
"sources": [
{
"db": "BID",
"id": "105843"
}
],
"trust": 0.3
},
"cve": "CVE-2018-18563",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"acInsufInfo": false,
"accessComplexity": "LOW",
"accessVector": "ADJACENT_NETWORK",
"authentication": "NONE",
"author": "NVD",
"availabilityImpact": "COMPLETE",
"baseScore": 8.3,
"confidentialityImpact": "COMPLETE",
"exploitabilityScore": 6.5,
"impactScore": 10.0,
"integrityImpact": "COMPLETE",
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"trust": 1.0,
"userInteractionRequired": false,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"acInsufInfo": null,
"accessComplexity": "Low",
"accessVector": "Adjacent Network",
"authentication": "None",
"author": "NVD",
"availabilityImpact": "Complete",
"baseScore": 8.3,
"confidentialityImpact": "Complete",
"exploitabilityScore": null,
"id": "CVE-2018-18563",
"impactScore": null,
"integrityImpact": "Complete",
"obtainAllPrivilege": null,
"obtainOtherPrivilege": null,
"obtainUserPrivilege": null,
"severity": "High",
"trust": 0.8,
"userInteractionRequired": null,
"vectorString": "AV:A/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "CNVD",
"availabilityImpact": "COMPLETE",
"baseScore": 5.9,
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.5,
"id": "CNVD-2018-25434",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.6,
"vectorString": "AV:A/AC:H/Au:S/C:N/I:C/A:C",
"version": "2.0"
},
{
"accessComplexity": "HIGH",
"accessVector": "ADJACENT_NETWORK",
"authentication": "SINGLE",
"author": "IVD",
"availabilityImpact": "COMPLETE",
"baseScore": 5.9,
"confidentialityImpact": "NONE",
"exploitabilityScore": 2.5,
"id": "7d81238f-463f-11e9-8b84-000c29342cb1",
"impactScore": 9.2,
"integrityImpact": "COMPLETE",
"severity": "MEDIUM",
"trust": 0.2,
"vectorString": "AV:A/AC:H/Au:S/C:N/I:C/A:C",
"version": "2.9 [IVD]"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "ADJACENT_NETWORK",
"author": "NVD",
"availabilityImpact": "HIGH",
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.8,
"impactScore": 6.0,
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
},
{
"attackComplexity": "Low",
"attackVector": "Adjacent Network",
"author": "NVD",
"availabilityImpact": "High",
"baseScore": 9.6,
"baseSeverity": "Critical",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2018-18563",
"impactScore": null,
"integrityImpact": "High",
"privilegesRequired": "None",
"scope": "Changed",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.0"
}
],
"severity": [
{
"author": "NVD",
"id": "CVE-2018-18563",
"trust": 1.8,
"value": "CRITICAL"
},
{
"author": "CNVD",
"id": "CNVD-2018-25434",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "CNNVD",
"id": "CNNVD-201811-116",
"trust": 0.6,
"value": "CRITICAL"
},
{
"author": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1",
"trust": 0.2,
"value": "CRITICAL"
}
]
}
],
"sources": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial Number below KQ0400000 or KS0400000) and cobas h 232 before 04.00.04 (Serial Number above KQ0400000 or KS0400000). Improper access control to a service command allows attackers in the adjacent network to execute arbitrary code on the system through a crafted Poct1-A message. plural Roche The product contains an access control vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. RocheAccu-ChekInformIIInstrument and others are hand-held blood test medical devices from Roche, Switzerland. There are device permission and access control vulnerabilities in the software update mechanism of several Roche devices. The vulnerability stems from the failure of the program to perform proper access control. The attacker can use the special update package to write the file to any file. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities:\n1. An authentication bypass vulnerability\n2. An OS command-injection vulnerability\n3. An arbitrary file-upload vulnerability\n4. A remote code-execution vulnerability\n5. An access bypass vulnerability\nAn attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions",
"sources": [
{
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
}
],
"trust": 2.61
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2018-18563",
"trust": 3.5
},
{
"db": "ICS CERT",
"id": "ICSMA-18-310-01",
"trust": 3.3
},
{
"db": "BID",
"id": "105843",
"trust": 1.9
},
{
"db": "CNVD",
"id": "CNVD-2018-25434",
"trust": 0.8
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116",
"trust": 0.8
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880",
"trust": 0.8
},
{
"db": "IVD",
"id": "7D81238F-463F-11E9-8B84-000C29342CB1",
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"id": "VAR-201811-0060",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
}
],
"trust": 1.542857146
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"ICS",
"Network device"
],
"sub_category": null,
"trust": 0.6
},
{
"category": [
"ICS"
],
"sub_category": null,
"trust": 0.2
}
],
"sources": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
}
]
},
"last_update_date": "2023-12-18T12:43:45.989000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Top Page",
"trust": 0.8,
"url": "https://diagnostics.roche.com/us/en/home.html"
},
{
"title": "Patches for multiple Roche device permissions and access control vulnerabilities",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchinfo/show/147339"
},
{
"title": "Multiple Roche Repair measures for device security vulnerabilities",
"trust": 0.6,
"url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=100318"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-434",
"trust": 1.0
},
{
"problemtype": "CWE-284",
"trust": 0.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "NVD",
"id": "CVE-2018-18563"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 3.3,
"url": "https://ics-cert.us-cert.gov/advisories/icsma-18-310-01"
},
{
"trust": 1.6,
"url": "http://www.securityfocus.com/bid/105843"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18563"
},
{
"trust": 0.8,
"url": "https://nvd.nist.gov/vuln/detail/cve-2018-18563"
},
{
"trust": 0.3,
"url": "https://www.roche.com/"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"db": "BID",
"id": "105843"
},
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"date": "2018-11-20T19:29:00.853000",
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"date": "2018-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-12-14T00:00:00",
"db": "CNVD",
"id": "CNVD-2018-25434"
},
{
"date": "2018-11-06T00:00:00",
"db": "BID",
"id": "105843"
},
{
"date": "2019-02-08T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2018-012880"
},
{
"date": "2019-10-03T00:03:26.223000",
"db": "NVD",
"id": "CVE-2018-18563"
},
{
"date": "2020-07-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote or local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "plural Roche Access control vulnerabilities in products",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2018-012880"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Code problem",
"sources": [
{
"db": "IVD",
"id": "7d81238f-463f-11e9-8b84-000c29342cb1"
},
{
"db": "CNNVD",
"id": "CNNVD-201811-116"
}
],
"trust": 0.8
}
}