CVE-2018-18564
High
Description
An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration.
SeverityHigh
CVSS7.4
Exploit probability—
ProductRoche Accu-chek Inform Ii Firmware
PublishedNov 20, 2018
First seenNov 20, 2018
How to fix
Update
- roche accu-chek_inform_ii_firmware03.06.00, 04.03.00 or later
- roche cobas_h_232_firmware04.00.04 or later
- roche coaguchek_pro_ii_firmware04.03.00 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| roche accu-chek_inform_ii_firmware | v < 03.06.00, 04.00.00 ≤ v < 04.03.00 | 03.06.00, 04.03.00 |
| roche cobas_h_232_firmware | v < 04.00.04 | 04.00.04 |
| roche coaguchek_pro_ii_firmware | v < 04.03.00 | 04.03.00 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.