How severe is CVE-2018-18979?

This vulnerability has a severity rating of HIGH with a CVSS score of 7.4 out of 10.

What type of vulnerability is CVE-2018-18979?

This is classified as CWE-798, which is a common weakness in software security.

CVE-2018-18979 - HIGH Severity | CVSS 7.4

Vulnerability Description

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded initialization vector. Extraction of the initialization vector is necessary for deciphering communications between this application and the backend server. This, in combination with retrieving any user's encrypted data from the Ascensia cloud through another vulnerability, allows an attacker to obtain and modify any patient's medical information.

Related Vulnerabilities

CVE-2018-10328

HIGH

CVSS:7.4(High)

Momentum Axel 720P 5.1.8 devices have a hardcoded password of streaming for the appagent account, which allows remote attackers to view the RTSP video stream.

CWE-7982018

CVE-2018-18978

HIGH

CVSS:7.4(High)

An issue was discovered in the Ascensia Contour NEXT ONE application for Android before 2019-01-15. It has a statically coded encryption key. Extraction of the encryption key is necessary for decipher...

CWE-7982018

CVE-2022-31460

HIGH

CVSS:7.4(High)

Owl Labs Meeting Owl 5.2.0.15 allows attackers to activate Tethering Mode with hard-coded hoothoot credentials via a certain c 150 value.

CWE-7982022

CVE-2023-45226

HIGH

CVSS:7.4(High)

The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to imperson...

CWE-7982023

CVE-2024-27170

HIGH

CVSS:7.4(High)

It was observed that all the Toshiba printers contain credentials used for WebDAV access in the readable file. Then, it is possible to get a full access with WebDAV to the printer. As for the affected...

CWE-7982024

CVE-2025-1724

HIGH

CVSS:7.4(High)

Zohocorp's ManageEngine Analytics Plus and Zoho Analytics on-premise versions older than 6130 are vulnerable to an AD only account takeover because of a hardcoded sensitive token.

CWE-7982025