Lucene search

[email protected]NVD:CVE-2018-18561

HistoryNov 20, 2018 - 7:29 p.m.

CVE-2018-18561

2018-11-2019:29:00

CWE-732

[email protected]

web.nvd.nist.gov

CVSS2

7.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

10.4%

JSON

An issue was discovered in Roche Accu-Chek Inform II Base Unit / Base Unit Hub before 03.01.04 and CoaguChek / cobas h232 Handheld Base Unit before 03.01.04. Insecure permissions in a service interface may allow authenticated attackers in the adjacent network to execute arbitrary commands on the operating system.

Affected configurations

Nvd

Node

rocheaccu-chek_inform_ii_firmwareRange<03.01.04

AND

rocheaccu-chek_inform_iiMatch-

Node

rochecobas_h_232_firmwareRange<03.01.04

AND

rochecobas_h_232Match-

Node

rochecoaguchek_firmwareRange<03.01.04

AND

rochecoaguchekMatch-

Node

rochebase_unit_hub_firmwareRange<03.01.04

AND

rochebase_unit_hubMatch-

VendorProductVersionCPE
rocheaccu-chek_inform_ii_firmware*cpe:2.3:o:roche:accu-chek_inform_ii_firmware:*:*:*:*:*:*:*:*
rocheaccu-chek_inform_ii-cpe:2.3:h:roche:accu-chek_inform_ii:-:*:*:*:*:*:*:*
rochecobas_h_232_firmware*cpe:2.3:o:roche:cobas_h_232_firmware:*:*:*:*:*:*:*:*
rochecobas_h_232-cpe:2.3:h:roche:cobas_h_232:-:*:*:*:*:*:*:*
rochecoaguchek_firmware*cpe:2.3:o:roche:coaguchek_firmware:*:*:*:*:*:*:*:*
rochecoaguchek-cpe:2.3:h:roche:coaguchek:-:*:*:*:*:*:*:*
rochebase_unit_hub_firmware*cpe:2.3:o:roche:base_unit_hub_firmware:*:*:*:*:*:*:*:*
rochebase_unit_hub-cpe:2.3:h:roche:base_unit_hub:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
roche	accu-chek_inform_ii_firmware	*	cpe:2.3:o:roche:accu-chek_inform_ii_firmware::::::::
roche	accu-chek_inform_ii	-	cpe:2.3:h:roche:accu-chek_inform_ii:-:::::::*
roche	cobas_h_232_firmware	*	cpe:2.3:o:roche:cobas_h_232_firmware::::::::
roche	cobas_h_232	-	cpe:2.3:h:roche:cobas_h_232:-:::::::*
roche	coaguchek_firmware	*	cpe:2.3:o:roche:coaguchek_firmware::::::::
roche	coaguchek	-	cpe:2.3:h:roche:coaguchek:-:::::::*
roche	base_unit_hub_firmware	*	cpe:2.3:o:roche:base_unit_hub_firmware::::::::
roche	base_unit_hub	-	cpe:2.3:h:roche:base_unit_hub:-:::::::*

References

www.securityfocus.com/bid/105843

ics-cert.us-cert.gov/advisories/ICSMA-18-310-01

CVSS2

7.7

Attack Vector

ADJACENT_NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:A/AC:L/Au:S/C:C/I:C/A:C

CVSS3

Attack Vector

ADJACENT

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.5

Confidence

High

EPSS

Percentile

10.4%

JSON

Related for NVD:CVE-2018-18561

cve1 prion1 cvelist1 ics1