Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2018-18564: Roche test devices let nearby attackers alter settings

CVE-2018-18564 · published 7 years ago

Summary

Older versions of Roche's Accu-Chek Inform II, CoaguChek Pro II and cobas h 232 devices can be accessed from a neighboring network, allowing someone to change the instrument's configuration. This could cause incorrect test results or disrupt operations. Update the device firmware to the latest version as soon as possible or contact Roche for a remediation patch.

What to do

Update roche cobas_h_232_firmware to version 04.00.04 or later.
Update roche coaguchek_pro_ii_firmware to version 04.03.00 or later.

Affected software

Vendor	Product	Affected versions
roche	accu-chek_inform_ii_firmware	< 03.06.00 >= 04.00.00, < 04.03.00 `cpe:2.3:o:roche:accu-chek_inform_ii_firmware::::::::`
roche	cobas_h_232_firmware	< 04.00.04 `cpe:2.3:o:roche:cobas_h_232_firmware::::::::`
roche	coaguchek_pro_ii_firmware	< 04.03.00 `cpe:2.3:o:roche:coaguchek_pro_ii_firmware::::::::`

Original advisory text

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). Improper access control allows attackers in the adjacent network to change the instrument configuration.

References

http://www.securityfocus.com/bid/105843 Third Party Advisory VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01 Mitigation Third Party Advisory US Government Resource

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Timeline

Published20 Nov 2018

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2018-18564 · NVD

Track software like this

Free during beta