Details of VAR-201811-0062

ID

VAR-201811-0062

CVE

CVE-2018-18565

TITLE

plural Roche Product unrestricted upload vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2018-012882

DESCRIPTION

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package. plural Roche The product contains a vulnerability related to unlimited uploads of dangerous types of files.Information may be tampered with. RocheAccu-ChekInformIIInstrument and others are hand-held blood test medical devices from Roche, Switzerland. Permissions and access control vulnerabilities exist in several Roche devices that an attacker can use to change configurations. Multiple Roche Point of Care Handheld Medical Services are prone to the following security vulnerabilities: 1. An authentication bypass vulnerability 2. An OS command-injection vulnerability 3. An arbitrary file-upload vulnerability 4. A remote code-execution vulnerability 5. An access bypass vulnerability An attacker can exploit these issues to bypass authentication mechanism, execute arbitrary commands and codes, upload arbitrary files, or to bypass security restrictions

Trust: 2.61

sources: NVD: CVE-2018-18565 // JVNDB: JVNDB-2018-012882 // CNVD: CNVD-2018-25430 // BID: 105843 // IVD: 7d80fc80-463f-11e9-86d0-000c29342cb1

IOT TAXONOMY

category:	['ICS', 'Network device']	sub_category:	-	Trust: 0.6
category:	['ICS']	sub_category:	-	Trust: 0.2

sources: IVD: 7d80fc80-463f-11e9-86d0-000c29342cb1 // CNVD: CNVD-2018-25430

AFFECTED PRODUCTS

vendor:	roche	model:	coaguchek pro ii	scope:	lt	version:	04.03.00	Trust: 1.6
vendor:	roche	model:	accu-chek inform ii	scope:	lt	version:	04.03.00	Trust: 1.0
vendor:	roche	model:	accu-chek inform ii	scope:	lt	version:	03.06.00	Trust: 1.0
vendor:	roche	model:	cobas h 232	scope:	lt	version:	03.01.03	Trust: 1.0
vendor:	roche	model:	cobas h 232	scope:	gte	version:	04.00.00	Trust: 1.0
vendor:	roche	model:	cobas h 232	scope:	lt	version:	04.00.04	Trust: 1.0
vendor:	roche	model:	coaguchek xs pro	scope:	lt	version:	03.01.06	Trust: 1.0
vendor:	roche	model:	coaguchek xs plus	scope:	lt	version:	03.01.06	Trust: 1.0
vendor:	roche	model:	accu-chek inform ii	scope:	gte	version:	04.00.00	Trust: 1.0
vendor:	roche diagnostics	model:	accu-chek inform ii	scope:	eq	version:	04.03.00	Trust: 0.8
vendor:	roche diagnostics	model:	accu-chek inform ii	scope:	lt	version:	of 04.x	Trust: 0.8
vendor:	roche	model:	accu-chek inform ii instrument	scope:	lt	version:	03.06.00	Trust: 0.6
vendor:	roche	model:	cobas h	scope:	eq	version:	232<03.01.03	Trust: 0.6
vendor:	roche	model:	cobas h	scope:	eq	version:	232<04.00.04	Trust: 0.6
vendor:	roche	model:	coaguchek xs plus and pro	scope:	lt	version:	03.01.06	Trust: 0.6
vendor:	accu chek inform ii	model:	-	scope:	eq	version:	*	Trust: 0.4
vendor:	cobas h 232	model:	-	scope:	eq	version:	*	Trust: 0.4
vendor:	roche	model:	cobas h	scope:	eq	version:	2320	Trust: 0.3
vendor:	roche	model:	coaguchek xs pro	scope:	eq	version:	0	Trust: 0.3
vendor:	roche	model:	coaguchek xs plus	scope:	eq	version:	0	Trust: 0.3
vendor:	roche	model:	coaguchek pro ii	scope:	eq	version:	0	Trust: 0.3
vendor:	roche	model:	coaguchek	scope:	eq	version:	0	Trust: 0.3
vendor:	roche	model:	accu-chek inform ii instrument	scope:	eq	version:	0	Trust: 0.3
vendor:	roche	model:	cobas h	scope:	ne	version:	2324.0.4	Trust: 0.3
vendor:	roche	model:	cobas h	scope:	ne	version:	2323.1.4	Trust: 0.3
vendor:	roche	model:	cobas h	scope:	ne	version:	2323.1.3	Trust: 0.3
vendor:	roche	model:	coaguchek xs pro	scope:	ne	version:	3.1.6	Trust: 0.3
vendor:	roche	model:	coaguchek xs plus	scope:	ne	version:	3.1.6	Trust: 0.3
vendor:	roche	model:	coaguchek pro ii	scope:	ne	version:	4.3	Trust: 0.3
vendor:	roche	model:	coaguchek	scope:	ne	version:	3.1.4	Trust: 0.3
vendor:	roche	model:	accu-chek inform ii instrument	scope:	ne	version:	3.6	Trust: 0.3
vendor:	coaguchek pro ii	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	coaguchek xs plus	model:	-	scope:	eq	version:	*	Trust: 0.2
vendor:	coaguchek xs pro	model:	-	scope:	eq	version:	*	Trust: 0.2

sources: IVD: 7d80fc80-463f-11e9-86d0-000c29342cb1 // CNVD: CNVD-2018-25430 // BID: 105843 // JVNDB: JVNDB-2018-012882 // NVD: CVE-2018-18565

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2018-18565
value:	MEDIUM
Trust: 1.0
NVD:	CVE-2018-18565
value:	MEDIUM
Trust: 0.8
CNVD:	CNVD-2018-25430
value:	MEDIUM
Trust: 0.6
CNNVD:	CNNVD-201811-118
value:	MEDIUM
Trust: 0.6
IVD:	7d80fc80-463f-11e9-86d0-000c29342cb1
value:	MEDIUM
Trust: 0.2

nvd@nist.gov:	CVE-2018-18565
severity:	MEDIUM
baseScore:	4.1
vectorString:	AV:A/AC:L/AU:S/C:N/I:P/A:P
accessVector:	ADJACENT_NETWORK
accessComplexity:	LOW
authentication:	SINGLE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	PARTIAL
exploitabilityScore:	5.1
impactScore:	4.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
CNVD:	CNVD-2018-25430
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:A/AC:H/AU:N/C:C/I:P/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	3.2
impactScore:	9.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6
IVD:	7d80fc80-463f-11e9-86d0-000c29342cb1
severity:	MEDIUM
baseScore:	6.5
vectorString:	AV:A/AC:H/AU:N/C:C/I:P/A:C
accessVector:	ADJACENT_NETWORK
accessComplexity:	HIGH
authentication:	NONE
confidentialityImpact:	COMPLETE
integrityImpact:	PARTIAL
availabilityImpact:	COMPLETE
exploitabilityScore:	3.2
impactScore:	9.5
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.9 [IVD]
Trust: 0.2

nvd@nist.gov:	CVE-2018-18565
baseSeverity:	MEDIUM
baseScore:	6.8
vectorString:	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N
attackVector:	ADJACENT
attackComplexity:	LOW
privilegesRequired:	LOW
userInteraction:	NONE
scope:	CHANGED
confidentialityImpact:	NONE
integrityImpact:	HIGH
availabilityImpact:	NONE
exploitabilityScore:	2.3
impactScore:	4.0
version:	3.0
Trust: 1.8

sources: IVD: 7d80fc80-463f-11e9-86d0-000c29342cb1 // CNVD: CNVD-2018-25430 // JVNDB: JVNDB-2018-012882 // CNNVD: CNNVD-201811-118 // NVD: CVE-2018-18565

PROBLEMTYPE DATA

problemtype:

CWE-434

Trust: 1.8

sources: JVNDB: JVNDB-2018-012882 // NVD: CVE-2018-18565

THREAT TYPE

specific network environment

Trust: 0.6

sources: CNNVD: CNNVD-201811-118

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201811-118

CONFIGURATIONS

sources: JVNDB: JVNDB-2018-012882

PATCH

title:	Top Page	url:	https://diagnostics.roche.com/us/en/home.html	Trust: 0.8
title:	Patches for Multiple Roche Device Permissions and Access Control Vulnerabilities (CNVD-2018-25430)	url:	https://www.cnvd.org.cn/patchInfo/show/147341	Trust: 0.6
title:	Multiple Roche Fixing measures for device permission permission and access control problems	url:	http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=123185	Trust: 0.6

sources: CNVD: CNVD-2018-25430 // JVNDB: JVNDB-2018-012882 // CNNVD: CNNVD-201811-118

EXTERNAL IDS

db:	NVD	id:	CVE-2018-18565	Trust: 3.5
db:	ICS CERT	id:	ICSMA-18-310-01	Trust: 3.3
db:	BID	id:	105843	Trust: 1.9
db:	CNVD	id:	CNVD-2018-25430	Trust: 0.8
db:	CNNVD	id:	CNNVD-201811-118	Trust: 0.8
db:	JVNDB	id:	JVNDB-2018-012882	Trust: 0.8
db:	IVD	id:	7D80FC80-463F-11E9-86D0-000C29342CB1	Trust: 0.2

sources: IVD: 7d80fc80-463f-11e9-86d0-000c29342cb1 // CNVD: CNVD-2018-25430 // BID: 105843 // JVNDB: JVNDB-2018-012882 // CNNVD: CNNVD-201811-118 // NVD: CVE-2018-18565

REFERENCES

url:	https://ics-cert.us-cert.gov/advisories/icsma-18-310-01	Trust: 3.3
url:	http://www.securityfocus.com/bid/105843	Trust: 1.6
url:	https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-18565	Trust: 0.8
url:	https://nvd.nist.gov/vuln/detail/cve-2018-18565	Trust: 0.8
url:	https://www.roche.com/	Trust: 0.3

sources: CNVD: CNVD-2018-25430 // BID: 105843 // JVNDB: JVNDB-2018-012882 // CNNVD: CNNVD-201811-118 // NVD: CVE-2018-18565

CREDITS

Niv Yehezkel of Medigate

Trust: 0.3

sources: BID: 105843

SOURCES

db:	IVD	id:	7d80fc80-463f-11e9-86d0-000c29342cb1
db:	CNVD	id:	CNVD-2018-25430
db:	BID	id:	105843
db:	JVNDB	id:	JVNDB-2018-012882
db:	CNNVD	id:	CNNVD-201811-118
db:	NVD	id:	CVE-2018-18565

LAST UPDATE DATE

2024-11-23T21:52:40.263000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2018-25430	date:	2018-12-14T00:00:00
db:	BID	id:	105843	date:	2018-11-06T00:00:00
db:	JVNDB	id:	JVNDB-2018-012882	date:	2019-02-08T00:00:00
db:	CNNVD	id:	CNNVD-201811-118	date:	2020-07-07T00:00:00
db:	NVD	id:	CVE-2018-18565	date:	2024-11-21T03:56:10.113

SOURCES RELEASE DATE

db:	IVD	id:	7d80fc80-463f-11e9-86d0-000c29342cb1	date:	2018-12-14T00:00:00
db:	CNVD	id:	CNVD-2018-25430	date:	2018-12-14T00:00:00
db:	BID	id:	105843	date:	2018-11-06T00:00:00
db:	JVNDB	id:	JVNDB-2018-012882	date:	2019-02-08T00:00:00
db:	CNNVD	id:	CNNVD-201811-118	date:	2018-11-07T00:00:00
db:	NVD	id:	CVE-2018-18565	date:	2018-11-20T19:29:00.963