Roche Diagnostics — 4 prefixes (MA-L)

A MAC address beginning with 00:0E:2F, 00:40:49, B8:78:79, or 00:60:19 belongs to Roche Diagnostics, the diagnostics division of F. Hoffmann-La Roche, typically found on hospital and clinical point-of-care instruments — blood-glucose meters, insulin-delivery systems, coagulation analyzers, and their networked base units.

These four IEEE MA-L blocks span three registrant name variants tied to the same corporate family: Roche Diagnostics GmbH in Mannheim, Germany (two blocks, one explicitly scoped to "Roche Diabetes Care Insulin Delivery Systems"), Roche Diagnostics International Ltd. in Rotkreuz, Switzerland, and an unsuffixed "Roche Diagnostics" registrant in Indianapolis, Indiana. Multiple assignments across related legal entities is itself evidence of company substance beyond a bare single-OUI registration.

The Indianapolis registrant traces a documented corporate lineage: Bio-Dynamics, founded 1964, was acquired by Boehringer Mannheim Corporation in 1974, and Boehringer Mannheim was renamed Roche Diagnostics GmbH after Roche's 1998 acquisition of its holding company, Corange Ltd. Product lines mapping to these OUIs include Accu-Chek (glucose meters and insulin delivery), CoaguChek (anticoagulation monitoring), cobas h 232 and cobas infinity (point-of-care analyzers), and the navify connectivity platform.

Roche's own advisory program and a 2018 CISA advisory (ICSMA-18-310-01) document network-relevant vulnerabilities in exactly this device population — improper authentication, command injection, and access-control flaws in Accu-Chek Inform II, CoaguChek, and cobas h 232 units, exploitable from an adjacent network. More recent Roche-disclosed issues affect the navify platform. Roche recommends segmenting connected instruments from general hospital networks.

IEEE assignment 00

0E:2F: Roche Diagnostics GmbH, "Roche Diabetes Care Insulin Delivery Systems", D-68305 Mannheim, DE [Confirmed] — IEEE MA-L (standards-oui.ieee.org/oui/oui.csv)

IEEE assignment 00

40:49: Roche Diagnostics International Ltd., Forrenstrasse, Rotkreuz, ZG, CH 6343 [Confirmed] — IEEE MA-L (standards-oui.ieee.org/oui/oui.csv)

IEEE assignment B8

78:79: Roche Diagnostics GmbH, Sandhofer Strasse 116, Mannheim, Baden-Württemberg, DE 68305 [Confirmed] — IEEE MA-L (standards-oui.ieee.org/oui/oui.csv)

IEEE assignment 00

60:19: Roche Diagnostics, 9115 Hague Road, Indianapolis, IN, US 46250-0457 [Confirmed] — IEEE MA-L (standards-oui.ieee.org/oui/oui.csv)

Registry / block size

MA-L (24-bit OUI) x4 blocks; IEEE does not publish a per-company total [Confirmed] — IEEE the IEEE MA-L registry

HQ / country

corporate parent F. Hoffmann-La Roche Ltd, Basel, CH; registrants span Mannheim DE, Rotkreuz CH, and Indianapolis US [Confirmed] — IEEE MA-L

Company status

active [Confirmed] — diagnostics.roche.com

Device types

blood-glucose meters, insulin-delivery systems, coagulation/anticoagulation monitors, point-of-care analyzers, networked base units/hubs [Confirmed] — diagnostics.roche.com

Notable products

Accu-Chek, CoaguChek, cobas h 232, cobas infinity, navify [Confirmed] — diagnostics.roche.com (product pages)

Corporate history

Indianapolis registrant traces to Bio-Dynamics (founded 1964) → acquired by Boehringer Mannheim Corporation (1974) → renamed Roche Diagnostics GmbH after Roche's 1998 acquisition of holding company Corange Ltd [Confirmed] — indyencyclopedia.org, thepharmaletter.com

Security history

CISA ICSMA-18-310-01 (2018, Update A) — five CVEs (CVE-2018-18561 through CVE-2018-18565), CVSS 6.5–8.3, affecting Accu-Chek Inform II, CoaguChek Pro II/XS Plus/XS Pro, and cobas h 232 base units/handhelds; improper authentication, OS command injection, unrestricted file upload, and access-control flaws exploitable from an adjacent network [Confirmed — CISA's own page returned HTTP 403 to direct fetch; corroborated by two independent secondary sources] — hipaajournal.com, latesthackingnews.com

Recent advisories

navify Digital Pathology default-credentials (RabbitMQ management interface) vulnerability, CVSS 8.8 High, versions 2.0.0–2.4.1; navify Monitoring API input-validation DoS; a 2026 FortiBleed exposure check found "no evidence of impact to customer Roche Laboratory Networks"

[Confirmed] — diagnostics.roche.com/global/en/legal/product-security-advisory.html

Registration dates

Unknown — IEEE's public OUI data (Registry, Assignment, Organization Name, Organization Address columns) contains no assignment/registration date; a third-party "date registered" value would be a database artifact, not an IEEE fact [Confirmed] — IEEE the IEEE MA-L registry column set

Related vendors

F. Hoffmann-La Roche Ltd (parent); Boehringer Mannheim Corporation (historical predecessor, renamed Roche Diagnostics GmbH in 1998)

Analyst note

four OUI assignments across two Roche Diagnostics legal entities, one explicitly tied to a named product line ("Insulin Delivery Systems"), plus a documented corporate lineage and an ongoing vendor security-advisory program, together establish company substance beyond a bare single-OUI shell registration.