CVE-2018-18975

Vulnerability

The Ascensia Contour NEXT ONE iOS app prior to 2019-01-15 implements certificate pinning in a weak manner, allowing an attacker to proxy communications between the app and Ascensia backend servers. The weakness stems from the client not properly validating the server certificate chain, enabling a man-in-the-middle (MITM) attack [1]. All versions before the 2019-01-15 update are affected.

Exploitation

An attacker with a network position between the mobile app and the backend (e.g., on a compromised Wi-Fi network or via a rogue cellular tower) can bypass the weak certificate pinning and intercept the encrypted TLS connection. The attacker can then proxy all communications, which includes authentication tokens and medical data transmissions [1]. No user interaction beyond using the app is required.

Impact

Successful exploitation allows the attacker to disclose medical information, including glucometer readings and related personal health data [1]. Additionally, an attacker could modify stored glucometer readings by tampering with the proxied requests, potentially affecting medical staff's treatment decisions [1]. The compromise is at the application layer, giving the attacker access to the victim's account profile and synchronized health data.

Mitigation

Ascensia patched the weak certificate-pinning implementation in an update released on 2019-01-15 [1]. Users should ensure the Contour NEXT ONE iOS app is updated to the latest version. No workaround is available for unpatched versions. The vulnerability is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.