What’s Vulnerable › Vulnerabilities

CVE-2018-18976

• Severity: medium (CVSS 5.3 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2019-05-06 · updated 2026-06-17
• Weakness: CWE-639

Description

An issue was discovered in the Ascensia Contour NEXT ONE application for iOS and Android before 2019-01-15. An attacker may retrieve encrypted medical information of any user of the Ascensia cloud platform by performing Direct Object References with a series of user ID values. (This information can be decrypted through a different vulnerability.)

Affected products

• Ascensia Contour Diabetes: before 2.4.30; before 2.5.0 — fixed in 2.4.30, 2.5.0

How to fix

Upgrade to a fixed version: Ascensia Contour Diabetes 2.4.30, 2.5.0. Check the vendor advisory for mitigations.

References

• https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic
• https://depthsecurity.com/blog/medical-exploitation-you-are-now-diabetic

Get alerted when CVE-2018-18976 or the next vulnerability affects your stack