{"cve":"CVE-2018-18563","nvd":{"published":"2018-11-20T19:29:00.853","modified":"2026-06-17T01:47:30.673","status":"Modified","description":"An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial Number below KQ0400000 or KS0400000) and cobas h 232 before 04.00.04 (Serial Number above KQ0400000 or KS0400000). Improper access control to a service command allows attackers in the adjacent network to execute arbitrary code on the system through a crafted Poct1-A message.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":9.6},"cwes":["CWE-434"],"references":["http://www.securityfocus.com/bid/105843","https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01","http://www.securityfocus.com/bid/105843","https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01"],"products":["roche:accu-chek_inform_ii_firmware","roche:coaguchek_pro_ii_firmware","roche:coaguchek_xs_plus_firmware","roche:coaguchek_xs_pro_firmware","roche:cobas_h_232_firmware"],"source":"nvd","synced_at":"2026-10-19T20:53:59.789560037+00:00"},"epss":{"cve":"CVE-2018-18563","score":0.0097,"percentile":0.61916,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}