Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Ascensia Contour NEXT ONE iOS app can be proxied

CVE-2018-18975 · published 7 years ago
Summary

The Ascensia Contour NEXT ONE diabetes app for iPhones before January 15, 2019 does not properly verify the server it talks to. This weakness lets an attacker place themselves between the app and Ascensia's servers and see the medical data being sent. Update the app to the latest version or install the vendor's security patch as soon as possible.

What to do
  • Update ascensia contour_diabetes to version 2.4.30 or later.
Affected software
VendorProductAffected versions
ascensia contour_diabetes < 2.4.30
cpe:2.3:a:ascensia:contour_diabetes:*:*:*:*:*:iphone_os:*:*
Original advisory text
An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certifica...
An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certificate-pinning implementation, leading to disclosure of medical information.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-200Information Exposure
Timeline
Published6 May 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-18975 · NVD
Track software like this
Free during beta