Quantum Secular Labs / Blog / Advisories

CVE-2018-18563: Improper access control to a service command allows attackers in the adjacent network to execute arbitrary…

CVE-2018-18563 is rated critical with a CVSS v3.0 base score of 9.6 and NVD lists 5 affected products, including Roche Accu Chek Inform Ii Firmware. Per its scoring, it can be exploited without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.

Vulnerability description

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial Number below KQ0400000 or KS0400000) and cobas h 232 before 04.00.04 (Serial Number above KQ0400000 or KS0400000). Improper access control to a service command allows attackers in the adjacent network to execute arbitrary code on the system through a crafted Poct1-A message.

Severity breakdown

CVSS v3.0 9.6: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

  • Attack vector: Adjacent. The attacker must be on the same shared network segment.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: None. No account or prior access is needed.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-434: Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Affected products

  • Roche Accu Chek Inform Ii Firmware: before 03.06.00; from 04.00.00 before 04.03.00
  • Roche Cobas H 232 Firmware: before 03.01.03; from 04.00.00 before 04.00.04
  • Roche Coaguchek Pro Ii Firmware: before 04.03.00
  • Roche Coaguchek Xs Plus Firmware: before 03.01.06
  • Roche Coaguchek Xs Pro Firmware: before 03.01.06

References