{"cve":"CVE-2018-18565","nvd":{"published":"2018-11-20T19:29:00.963","modified":"2026-06-17T01:47:30.957","status":"Modified","description":"An issue was discovered in Roche Accu-Chek Inform II Instrument before 03.06.00 (Serial number below 14000) and 04.x before 04.03.00 (Serial Number above 14000), CoaguChek Pro II before 04.03.00, CoaguChek XS Plus before 03.01.06, CoaguChek XS Pro before 03.01.06, cobas h 232 before 03.01.03 (Serial number below KQ0400000 or KS0400000), and cobas h 232 before 04.00.04 (Serial number above KQ0400000 or KS0400000). A vulnerability in the software update mechanism allows authenticated attackers in the adjacent network to overwrite arbitrary files on the system through a crafted update package.","cvss_v4":null,"cvss_v3":{"version":"3.0","vector":"CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N","score":6.8},"cwes":["CWE-434"],"references":["http://www.securityfocus.com/bid/105843","https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01","http://www.securityfocus.com/bid/105843","https://ics-cert.us-cert.gov/advisories/ICSMA-18-310-01"],"products":["roche:accu-chek_inform_ii_firmware","roche:coaguchek_pro_ii_firmware","roche:coaguchek_xs_plus_firmware","roche:coaguchek_xs_pro_firmware","roche:cobas_h_232_firmware"],"source":"nvd","synced_at":"2026-10-19T20:53:59.789560037+00:00"},"epss":{"cve":"CVE-2018-18565","score":0.00475,"percentile":0.41077,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}