CVE-2018-18975

Published: May 6, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in the Ascensia Contour NEXT ONE app for iOS before 2019-01-15. An attacker may proxy communications between the app and Ascensia backend servers because of a weak certificate-pinning implementation, leading to disclosure of medical information.

Affected (1)

Products: Ascensia: Contour Diabetes

1 product

Contour Diabetes

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Ascensia Contour Diabetes	Before 2.4.30

Related CWEs

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (2)

https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic

Source: cve@mitre.org

ExploitTechnical DescriptionThird Party Advisory

https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitTechnical DescriptionThird Party Advisory

Timeline

No history available yet.