Vulnerability

Roche Accu-Chek and CoaguChek point of care handhelds expose a weakly protected service interface

MedDevice Cyber Staff · Nov 6 · 4 min read · Via CISA ICSMA-18-310-01

CISA published advisory ICSMA-18-310-01 (Update A) on November 6, 2018, covering five vulnerabilities in Roche Diagnostics point of care handheld devices. Affected products are the Accu-Chek Inform II and its base units, CoaguChek Pro II, CoaguChek XS Plus, CoaguChek XS Pro, cobas h 232 POC, and the base units and handheld base units that dock them. Niv Yehezkel of Medigate reported the issues.

Every CVE needs an attacker on the adjacent network, which for these handhelds means the hospital's Ethernet or Wi-Fi segment.

CVE-2018-18561 (CWE-287, CVSS v3 6.5) is weak access credentials on a service interface. CVE-2018-18562 (CWE-78, CVSS v3 8.0) lets an authenticated attacker execute arbitrary operating system commands through insecure permissions on that interface. CVE-2018-18564 (CWE-284, CVSS v3 8.3) allows arbitrary code execution through a crafted message to a service command, and CVE-2018-18565 (CWE-284, CVSS v3 8.2) allows changes to the instrument configuration.

CVE-2018-18563 (CWE-434, CVSS v3 8.0) sits in the software update mechanism, where a crafted update package can overwrite arbitrary files. For the Accu-Chek Inform II instrument, CISA lists all versions before 03.06.00 for serial numbers below 14000 and before 04.03.00 for serial numbers above 14000.

The risk evaluation is plain: unauthorized access to modify system settings or execute arbitrary code. On a glucose or coagulation meter, a changed configuration can mean a wrong result at the bedside.

Roche scheduled new software updates for all affected products with availability beginning November 2018, and published mitigation procedures for connected (Ethernet and Wi-Fi) and non-connected devices. A service interface that answers anyone on the ward network deserves the same authentication as the clinical workflow.

Are you a representative of Roche? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Install Roche's software updates for the affected Accu-Chek, CoaguChek and cobas h 232 handhelds and base units, released starting November 2018. For the Accu-Chek Inform II instrument, move past 03.06.00 (serial below 14000) or 04.03.00 (serial above 14000). Until updated, keep the devices on a segment that only the point of care data management hosts can reach.

Apply the Roche software updates. Contact a local Roche Diagnostics office for the updates scheduled from November 2018 for every affected handheld and base unit.
Isolate connected devices. Place Ethernet and Wi-Fi connected handhelds and base units on a restricted segment, following Roche's procedures for connected devices.
Restrict the service interface. Block access to service ports from general clinical networks, since four of the five CVEs run through service functions.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Required

Wired network

Contributing

Wireless connectivity Field-updatable firmware Hospital network

Accu-Chek Inform II

PID-41 PID-27 Field-updatable firmware Wireless connectivity Wired network

Fix the class in your product

The login worked; the authorization did not follow through on every object the request names. As the maker, authorize every object reference on the server against the caller, return uniform responses so nothing can be enumerated, and strip internal detail from what the backend returns.

Authorize per object. Check on the server that the caller may see the specific record a request names, on every request.
Answer uniformly. Login and lookup respond identically for present and absent accounts.
Return generic errors. Log detail server-side; never leak internal state to the client.

Mapped EMB3D mitigations

Products potentially also affected

Products whose own public documentation shares this advisory's attributes. A shared attribute is a lead, not a finding. The status column shows only what each manufacturer has said.

Product	Manufacturer	Shared with this advisory	Manufacturer status
Assert-IQ Insertable Cardiac Monitor	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
FreeStyle Libre 3 Continuous Glucose Monitoring System	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
ID NOW COVID-19 2.0	Abbott	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Embryo Predict	Alife Health	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
Novum IQ Large Volume Pump	Baxter	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
WAVE Clinical Platform	Baxter	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
BD Alaris Infusion System with Guardrails Suite MX	BD	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
BD Phoenix Automated Microbiology System	BD	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
LUX-Dx II (M302); LUX-Dx II+	Boston Scientific	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
Image Suite	Carestream Health	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
Dexcom G6 Continuous Glucose Monitoring (CGM) System	DexCom	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
MOSAIQ Oncology Information System	Elekta	Exposed to the same EMB3D threatTID-226	No feedback feed from manufacturer
aPROMISE X	Exini Diagnostics	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
Synapse PACS	Fujifilm Healthcare	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer
Universal Viewer	GE HealthCare	Exposed to the same EMB3D threatTID-324	No feedback feed from manufacturer

25 more products match. Each manufacturer page lists its products and the advisories they share attributes with.

Questions & Answers

Which Roche point of care devices are affected by ICSMA-18-310-01?

CISA advisory ICSMA-18-310-01, published November 6, 2018, covers the Roche Diagnostics Accu-Chek Inform II and its base units, CoaguChek Pro II, CoaguChek XS Plus, CoaguChek XS Pro, cobas h 232 POC, and related base units and handheld base units. It lists CVE-2018-18561 through CVE-2018-18565.

What is CVE-2018-18564 in Roche Accu-Chek Inform II?

CVE-2018-18564 (CVSS v3 8.3) is improper access control to a service command that lets an attacker on the adjacent network execute arbitrary code through a crafted message on Roche point of care handhelds, per CISA advisory ICSMA-18-310-01 of November 6, 2018.

When did Roche release fixes for the Accu-Chek and CoaguChek vulnerabilities?

Roche Diagnostics scheduled new software updates for all products in CISA advisory ICSMA-18-310-01, with availability beginning November 2018. For CVE-2018-18563 on the Accu-Chek Inform II instrument, versions before 03.06.00 (serial below 14000) and 04.03.00 (serial above 14000) are affected.

← Back to Vulnerabilities