What is the CVSS score of CVE-2018-18565?

CVE-2018-18565 has a CVSS 3.0 base score of 6.8 (Medium). CVSS vector: CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N. EPSS exploitation probability: 0.5%.

Accu Chek Inform Ii Firmware CVE-2018-18565

MEDIUM

Unrestricted Upload of File with Dangerous Type (CWE-434)

2018-11-20 cve@mitre.org

File Upload Accu Chek Inform Ii Firmware Cobas H 232 Firmware Coaguchek Pro Ii Firmware Coaguchek Xs Plus Firmware Coaguchek Xs Pro Firmware

6.8

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

CVE Published

Nov 20, 2018 - 19:29 nvd

MEDIUM 6.8

DescriptionNVD

An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package.

AnalysisAI

Technical ContextAI

This vulnerability is classified as Unrestricted File Upload (CWE-434), which allows attackers to upload malicious files that can be executed on the server. An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package. Affected products include: Roche Accu-Chek Inform Ii Firmware, Roche Cobas H 232 Firmware, Roche Coaguchek Pro Ii Firmware, Roche Coaguchek Xs Plus Firmware, Roche Coaguchek Xs Pro Firmware. Version information: before 03.06.00.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Validate file types server-side, store uploads outside webroot, use random filenames, scan for malware.