Details of VAR-201710-0790

ID

VAR-201710-0790

CVE

CVE-2017-13993

TITLE

i-SENS SmartLog Diabetes Management Software Code execution vulnerability

Trust: 0.8

sources: IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954 // CNVD: CNVD-2017-25724

DESCRIPTION

An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled search path element vulnerability has been identified which could be exploited by placing a specially crafted DLL file in the search path. If the malicious DLL is loaded prior to the valid DLL, an attacker could execute arbitrary code on the system. This vulnerability does not affect the connected blood glucose monitor and would not impact delivery of therapy to the patient. SmartLog Diabetes Management Software is software for tracking and monitoring individual blood glucose levels by connecting a blood glucose meter to a computer via USB. i-SENS SmartLog Diabetes Management Software has a code execution vulnerability

Trust: 2.61

sources: NVD: CVE-2017-13993 // JVNDB: JVNDB-2017-009405 // CNVD: CNVD-2017-25724 // BID: 100659 // IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954

IOT TAXONOMY

category:

['ICS']

sub_category:

Trust: 0.8

sources: IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954 // CNVD: CNVD-2017-25724

AFFECTED PRODUCTS

vendor:	i sens	model:	smartlog diabetes management software	scope:	lte	version:	2.4.0	Trust: 1.8
vendor:	i sens	model:	smartlog diabetes management software	scope:	eq	version:	2.4.0	Trust: 0.9
vendor:	i sens	model:	smartlog diabetes management software	scope:	lte	version:	<=2.4.0	Trust: 0.6
vendor:	i sens	model:	smartlog diabetes management software	scope:	ne	version:	2.4.1	Trust: 0.3
vendor:	smartlog diabetes management	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954 // CNVD: CNVD-2017-25724 // BID: 100659 // JVNDB: JVNDB-2017-009405 // CNNVD: CNNVD-201709-527 // NVD: CVE-2017-13993

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2017-13993
value:	HIGH
Trust: 1.0
NVD:	CVE-2017-13993
value:	HIGH
Trust: 0.8
CNVD:	CNVD-2017-25724
value:	HIGH
Trust: 0.6
CNNVD:	CNNVD-201709-527
value:	HIGH
Trust: 0.6
IVD:	78f2231c-fb79-43f8-9428-2a4daaeb1954
value:	HIGH
Trust: 0.2

nvd@nist.gov:	CVE-2017-13993
severity:	HIGH
baseScore:	9.3
vectorString:	AV:N/AC:M/AU:N/C:C/I:C/A:C
accessVector:	NETWORK
accessComplexity:	MEDIUM
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	8.6
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2017-25724
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	78f2231c-fb79-43f8-9428-2a4daaeb1954
severity:	HIGH
baseScore:	7.2
vectorString:	AV:L/AC:L/AU:N/C:C/I:C/A:C
accessVector:	LOCAL
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	COMPLETE
availabilityImpact:	COMPLETE
exploitabilityScore:	3.9
impactScore:	10.0
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2017-13993
baseSeverity:	HIGH
baseScore:	7.8
vectorString:	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
attackVector:	LOCAL
attackComplexity:	LOW
privilegesRequired:	NONE
userInteraction:	REQUIRED
scope:	UNCHANGED
confidentialityImpact:	HIGH
integrityImpact:	HIGH
availabilityImpact:	HIGH
exploitabilityScore:	1.8
impactScore:	5.9
version:	3.0
Trust: 1.8

sources: IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954 // CNVD: CNVD-2017-25724 // JVNDB: JVNDB-2017-009405 // CNNVD: CNNVD-201709-527 // NVD: CVE-2017-13993

PROBLEMTYPE DATA

problemtype:	CWE-427	Trust: 1.8
problemtype:	CWE-428	Trust: 1.0

sources: JVNDB: JVNDB-2017-009405 // NVD: CVE-2017-13993

THREAT TYPE

local

Trust: 0.9

sources: BID: 100659 // CNNVD: CNNVD-201709-527

TYPE

Code problem

Trust: 0.8

sources: IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954 // CNNVD: CNNVD-201709-527

CONFIGURATIONS

sources: JVNDB: JVNDB-2017-009405

PATCH

title:	SmartLog	url:	http://www.caresens.com.au/products/software/smartlog	Trust: 0.8
title:	Patch for i-SENS SmartLog Diabetes Management Software Code Execution Vulnerability	url:	https://www.cnvd.org.cn/patchInfo/show/101788	Trust: 0.6
title:	i-SENS SmartLog Diabetes Management Software Security vulnerabilities	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=74734	Trust: 0.6

sources: CNVD: CNVD-2017-25724 // JVNDB: JVNDB-2017-009405 // CNNVD: CNNVD-201709-527

EXTERNAL IDS

db:	NVD	id:	CVE-2017-13993	Trust: 3.5
db:	ICS CERT	id:	ICSMA-17-250-01	Trust: 3.3
db:	BID	id:	100659	Trust: 1.9
db:	CNVD	id:	CNVD-2017-25724	Trust: 0.8
db:	CNNVD	id:	CNNVD-201709-527	Trust: 0.8
db:	JVNDB	id:	JVNDB-2017-009405	Trust: 0.8
db:	IVD	id:	78F2231C-FB79-43F8-9428-2A4DAAEB1954	Trust: 0.2

sources: IVD: 78f2231c-fb79-43f8-9428-2a4daaeb1954 // CNVD: CNVD-2017-25724 // BID: 100659 // JVNDB: JVNDB-2017-009405 // CNNVD: CNNVD-201709-527 // NVD: CVE-2017-13993

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsma-17-250-01	Trust: 3.3
url:	http://www.securityfocus.com/bid/100659	Trust: 1.6
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2017-13993	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2017-13993	Trust: 0.8
url:	http://www.caresens.com.au/products/software/smartlog	Trust: 0.3

sources: CNVD: CNVD-2017-25724 // BID: 100659 // JVNDB: JVNDB-2017-009405 // CNNVD: CNNVD-201709-527 // NVD: CVE-2017-13993

CREDITS

Mark Cross

Trust: 0.9

sources: BID: 100659 // CNNVD: CNNVD-201709-527

SOURCES

db:	IVD	id:	78f2231c-fb79-43f8-9428-2a4daaeb1954
db:	CNVD	id:	CNVD-2017-25724
db:	BID	id:	100659
db:	JVNDB	id:	JVNDB-2017-009405
db:	CNNVD	id:	CNNVD-201709-527
db:	NVD	id:	CVE-2017-13993

LAST UPDATE DATE

2025-04-20T23:12:51.948000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2017-25724	date:	2017-09-08T00:00:00
db:	BID	id:	100659	date:	2017-09-07T00:00:00
db:	JVNDB	id:	JVNDB-2017-009405	date:	2017-11-10T00:00:00
db:	CNNVD	id:	CNNVD-201709-527	date:	2019-10-17T00:00:00
db:	NVD	id:	CVE-2017-13993	date:	2025-04-20T01:37:25.860

SOURCES RELEASE DATE

db:	IVD	id:	78f2231c-fb79-43f8-9428-2a4daaeb1954	date:	2017-09-08T00:00:00
db:	CNVD	id:	CNVD-2017-25724	date:	2017-09-08T00:00:00
db:	BID	id:	100659	date:	2017-09-07T00:00:00
db:	JVNDB	id:	JVNDB-2017-009405	date:	2017-11-10T00:00:00
db:	CNNVD	id:	CNNVD-201709-527	date:	2017-09-13T00:00:00
db:	NVD	id:	CVE-2017-13993	date:	2017-10-05T01:29:05.197