Vulnerabilites related to illumina - miseq
Vulnerability from fkie_nvd
Published
2023-04-28 19:15
Modified
2024-11-21 07:40
Severity ?
7.4 (High) - CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
Instruments with Illumina Universal Copy Service v1.x and
v2.x contain an unnecessary privileges vulnerability. An unauthenticated
malicious actor could upload and execute code remotely at the operating system
level, which could allow an attacker to change settings, configurations,
software, or access sensitive data on the affected product.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html | Vendor Advisory | |
| ics-cert@hq.dhs.gov | https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | iscan_firmware | 4.0.0 | |
| illumina | iscan_firmware | 4.0.5 | |
| illumina | iscan | - | |
| illumina | iseq_100_firmware | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq_firmware | * | |
| illumina | miniseq | - | |
| illumina | miseq_firmware | * | |
| illumina | miseq | - | |
| illumina | miseqdx_firmware | * | |
| illumina | miseqdx_firmware | 4.0 | |
| illumina | miseqdx | - | |
| illumina | nextseq_500_firmware | 4.0 | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550_firmware | 4.0 | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx_firmware | * | |
| illumina | nextseq_550dx_firmware | * | |
| illumina | nextseq_550dx_firmware | 4.0 | |
| illumina | nextseq_550dx | - | |
| illumina | nextseq_1000_firmware | 1.4.1 | |
| illumina | nextseq_1000 | - | |
| illumina | nextseq_2000_firmware | 1.4.1 | |
| illumina | nextseq_2000 | - | |
| illumina | novaseq_6000_firmware | * | |
| illumina | novaseq_6000_firmware | 1.8 | |
| illumina | novaseq_6000 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:iscan_firmware:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B5000279-D40B-4526-B911-9E0641736EE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:iscan_firmware:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "BD7BE281-02B5-4B87-A7E2-D0E3BB5309CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iscan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08732A94-734B-486E-AB2C-A2E2CA3C66AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:iseq_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D22304CE-8F36-4B51-BAA2-E2C564C04CDF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:miniseq_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B7C1F7-D185-4C72-B23C-A21103267CD6",
"versionStartIncluding": "2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:miseq_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC028805-6ED3-455B-8F4C-95A8B8C5E756",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:miseqdx_firmware:*:*:*:*:-:*:*:*",
"matchCriteriaId": "E97A49E3-4B87-4FE5-8FD4-5B36C61A0650",
"versionStartIncluding": "4.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:miseqdx_firmware:4.0:*:*:*:ruo:*:*:*",
"matchCriteriaId": "BE1CBD4E-42B1-42C6-9B3F-4F715A5DBF6D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:miseqdx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBD56D9E-B16C-4ED4-A2E4-E73A3A9A599B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_500_firmware:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "22E34BB5-591C-4889-851E-9A66212C8B8C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_550_firmware:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D0D02B5D-7E8A-41CD-BE27-5B012BE5C016",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:*:*:*:*:-:*:*:*",
"matchCriteriaId": "93DC004D-271D-4075-9828-E88CD7FFC403",
"versionEndIncluding": "1.3.1",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:*:*:*:*:-:*:*:*",
"matchCriteriaId": "E199B789-BF31-40AC-B15E-31A97257002B",
"versionStartIncluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:4.0:*:*:*:ruo:*:*:*",
"matchCriteriaId": "78D581A6-38A5-4F0A-A5CB-B25A9337EE78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_1000_firmware:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "94B82675-AA38-4584-82BD-9C376F80EA49",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "93589C3C-F577-4C67-962F-166E28911ED2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_2000_firmware:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6671E6F8-85D5-4970-98FE-6189C8F98852",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "753D8FDF-5D25-46B9-8E66-30FB8E8A9A87",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:novaseq_6000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A429D26-AF22-4AC2-AB02-76C72B9B9B05",
"versionEndIncluding": "1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:novaseq_6000_firmware:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B4C702B1-4BAD-4E32-9659-D9F5C3F2F922",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:novaseq_6000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D879686-89E7-4152-AEF9-DC8A33FDA4A5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Instruments with Illumina Universal Copy Service v1.x and\nv2.x contain an unnecessary privileges vulnerability. An unauthenticated\nmalicious actor could upload and execute code remotely at the operating system\nlevel, which could allow an attacker to change settings, configurations,\nsoftware, or access sensitive data on the affected product.\n\n\n\n\n\n"
}
],
"id": "CVE-2023-1966",
"lastModified": "2024-11-21T07:40:14.730",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 0.7,
"impactScore": 6.0,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-28T19:15:16.573",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Vendor Advisory"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-250"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-24 15:15
Modified
2024-11-21 06:40
Severity ?
7.4 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
5.9 (Medium) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | local_run_manager | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq | - | |
| illumina | miseq | - | |
| illumina | miseq_dx | - | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B",
"versionEndIncluding": "3.1",
"versionStartIncluding": "1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."
},
{
"lang": "es",
"value": "LRM versiones 2.4 y anteriores, no implementa el cifrado TLS. Un actor malicioso puede realizar un ataque de tipo MITM a los datos confidenciales en tr\u00e1nsito, incluidas las credenciales"
}
],
"id": "CVE-2022-1524",
"lastModified": "2024-11-21T06:40:54.017",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 5.2,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 2.2,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-24T15:15:09.437",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-319"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-24 15:15
Modified
2024-11-21 06:40
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | local_run_manager | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq | - | |
| illumina | miseq | - | |
| illumina | miseq_dx | - | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B",
"versionEndIncluding": "3.1",
"versionStartIncluding": "1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."
},
{
"lang": "es",
"value": "LRM contiene una vulnerabilidad de salto de directorio que puede permitir a un actor malicioso subir archivos fuera de la estructura de directorios prevista"
}
],
"id": "CVE-2022-1518",
"lastModified": "2024-11-21T06:40:53.240",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-24T15:15:09.270",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-22"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-24 15:15
Modified
2024-11-21 06:40
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | local_run_manager | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq | - | |
| illumina | miseq | - | |
| illumina | miseq_dx | - | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B",
"versionEndIncluding": "3.1",
"versionStartIncluding": "1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network."
},
{
"lang": "es",
"value": "LRM usa altos privilegios. Un actor malicioso no autenticado puede cargar y ejecutar c\u00f3digo de forma remota a nivel del sistema operativo, lo que puede permitir a un atacante cambiar los ajustes, configuraciones, software o acceder a datos confidenciales en el producto afectado. Un atacante tambi\u00e9n podr\u00eda explotar esta vulnerabilidad para acceder a APIs no destinadas al uso general e interactuar mediante la red"
}
],
"id": "CVE-2022-1517",
"lastModified": "2024-11-21T06:40:53.083",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-24T15:15:09.220",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-250"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-269"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-24 15:15
Modified
2024-11-21 06:40
Severity ?
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
9.1 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Summary
LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | local_run_manager | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq | - | |
| illumina | miseq | - | |
| illumina | miseq_dx | - | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B",
"versionEndIncluding": "3.1",
"versionStartIncluding": "1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data."
},
{
"lang": "es",
"value": "LRM no implementa la autenticaci\u00f3n ni la autorizaci\u00f3n por defecto. Un actor malicioso puede inyectar, reproducir, modificar y/o interceptar datos confidenciales"
}
],
"id": "CVE-2022-1521",
"lastModified": "2024-11-21T06:40:53.613",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 4.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.2,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-24T15:15:09.390",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-284"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-306"
},
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2023-04-28 19:15
Modified
2024-11-21 07:40
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Summary
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html | Vendor Advisory | |
| ics-cert@hq.dhs.gov | https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | iscan_firmware | 4.0.0 | |
| illumina | iscan_firmware | 4.0.5 | |
| illumina | iscan | - | |
| illumina | iseq_100_firmware | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq_firmware | * | |
| illumina | miniseq | - | |
| illumina | miseq_firmware | * | |
| illumina | miseq | - | |
| illumina | miseqdx_firmware | * | |
| illumina | miseqdx_firmware | 4.0 | |
| illumina | miseqdx | - | |
| illumina | nextseq_500_firmware | 4.0 | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550_firmware | 4.0 | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx_firmware | * | |
| illumina | nextseq_550dx_firmware | * | |
| illumina | nextseq_550dx_firmware | 4.0 | |
| illumina | nextseq_550dx | - | |
| illumina | nextseq_1000_firmware | 1.4.1 | |
| illumina | nextseq_1000 | - | |
| illumina | nextseq_2000_firmware | 1.4.1 | |
| illumina | nextseq_2000 | - | |
| illumina | novaseq_6000_firmware | * | |
| illumina | novaseq_6000_firmware | 1.8 | |
| illumina | novaseq_6000 | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:iscan_firmware:4.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B5000279-D40B-4526-B911-9E0641736EE1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:iscan_firmware:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "BD7BE281-02B5-4B87-A7E2-D0E3BB5309CF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iscan:-:*:*:*:*:*:*:*",
"matchCriteriaId": "08732A94-734B-486E-AB2C-A2E2CA3C66AE",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:iseq_100_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D22304CE-8F36-4B51-BAA2-E2C564C04CDF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:miniseq_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "E4B7C1F7-D185-4C72-B23C-A21103267CD6",
"versionStartIncluding": "2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:miseq_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CC028805-6ED3-455B-8F4C-95A8B8C5E756",
"versionStartIncluding": "4.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:miseqdx_firmware:*:*:*:*:-:*:*:*",
"matchCriteriaId": "E97A49E3-4B87-4FE5-8FD4-5B36C61A0650",
"versionStartIncluding": "4.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:miseqdx_firmware:4.0:*:*:*:ruo:*:*:*",
"matchCriteriaId": "BE1CBD4E-42B1-42C6-9B3F-4F715A5DBF6D",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:miseqdx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "CBD56D9E-B16C-4ED4-A2E4-E73A3A9A599B",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_500_firmware:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "22E34BB5-591C-4889-851E-9A66212C8B8C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_550_firmware:4.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D0D02B5D-7E8A-41CD-BE27-5B012BE5C016",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:*:*:*:*:-:*:*:*",
"matchCriteriaId": "93DC004D-271D-4075-9828-E88CD7FFC403",
"versionEndIncluding": "1.3.1",
"versionStartIncluding": "1.0.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:*:*:*:*:-:*:*:*",
"matchCriteriaId": "E199B789-BF31-40AC-B15E-31A97257002B",
"versionStartIncluding": "1.3.3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:4.0:*:*:*:ruo:*:*:*",
"matchCriteriaId": "78D581A6-38A5-4F0A-A5CB-B25A9337EE78",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_1000_firmware:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "94B82675-AA38-4584-82BD-9C376F80EA49",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_1000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "93589C3C-F577-4C67-962F-166E28911ED2",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:nextseq_2000_firmware:1.4.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6671E6F8-85D5-4970-98FE-6189C8F98852",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:nextseq_2000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "753D8FDF-5D25-46B9-8E66-30FB8E8A9A87",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:illumina:novaseq_6000_firmware:*:*:*:*:*:*:*:*",
"matchCriteriaId": "3A429D26-AF22-4AC2-AB02-76C72B9B9B05",
"versionEndIncluding": "1.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:illumina:novaseq_6000_firmware:1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "B4C702B1-4BAD-4E32-9659-D9F5C3F2F922",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:novaseq_6000:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0D879686-89E7-4152-AEF9-DC8A33FDA4A5",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "\nInstruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. \n\n\n\n\n\n\n\n"
}
],
"id": "CVE-2023-1968",
"lastModified": "2024-11-21T07:40:14.970",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2023-04-28T19:15:16.647",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Vendor Advisory"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
},
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-1327"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "NVD-CWE-noinfo"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Vulnerability from fkie_nvd
Published
2022-06-24 15:15
Modified
2024-11-21 06:40
Severity ?
10.0 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| ics-cert@hq.dhs.gov | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource | |
| af854a3a-2127-422b-91ae-364da2661108 | https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 | Third Party Advisory, US Government Resource |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| illumina | local_run_manager | * | |
| illumina | iseq_100 | - | |
| illumina | miniseq | - | |
| illumina | miseq | - | |
| illumina | miseq_dx | - | |
| illumina | nextseq_500 | - | |
| illumina | nextseq_550 | - | |
| illumina | nextseq_550dx | - |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B",
"versionEndIncluding": "3.1",
"versionStartIncluding": "1.3",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
"matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
"matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
"matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
"matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707",
"vulnerable": false
},
{
"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
"matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."
},
{
"lang": "es",
"value": "LRM no restringe los tipos de archivos que pueden cargarse en el producto afectado. Un actor malicioso puede cargar cualquier tipo de archivo, incluyendo c\u00f3digo ejecutable que permite una explotaci\u00f3n de c\u00f3digo remoto"
}
],
"id": "CVE-2022-1519",
"lastModified": "2024-11-21T06:40:53.367",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
],
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 6.0,
"source": "ics-cert@hq.dhs.gov",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 5.9,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2022-06-24T15:15:09.333",
"references": [
{
"source": "ics-cert@hq.dhs.gov",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory",
"US Government Resource"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "ics-cert@hq.dhs.gov",
"type": "Primary"
}
]
}
CVE-2022-1521 (GCVE-0-2022-1521)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2025-04-16 16:16
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-284 - cwe-284
Summary
LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | NextSeq 550Dx |
Version: LRM Versions 1.3 to 3.1 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:10:03.014Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-1521",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:54:21.716090Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:16:46.654Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NextSeq 550Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 500 Instrumen",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 550 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "iSeq 100 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiniSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
}
],
"datePublic": "2022-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "cwe-284",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:15.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "3.2.4 IMPROPER ACCESS CONTROL CWE-284",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220602T06:00:00.000000Z",
"ID": "CVE-2022-1521",
"STATE": "PUBLIC",
"TITLE": "3.2.4 IMPROPER ACCESS CONTROL CWE-284"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 500 Instrumen",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "iSeq 100 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiniSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "cwe-284"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1521",
"datePublished": "2022-06-24T15:00:15.565Z",
"dateReserved": "2022-04-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:16:46.654Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1966 (GCVE-0-2023-1966)
Vulnerability from cvelistv5
Published
2023-04-28 18:06
Modified
2025-01-16 21:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-250 - Execution with Unnecessary Privileges
Summary
Instruments with Illumina Universal Copy Service v1.x and
v2.x contain an unnecessary privileges vulnerability. An unauthenticated
malicious actor could upload and execute code remotely at the operating system
level, which could allow an attacker to change settings, configurations,
software, or access sensitive data on the affected product.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | iScan Control Software |
Version: 4.0.0 Version: 4.0.5 |
|||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:05:27.096Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1966",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T20:30:42.910219Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T21:35:30.057Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iScan Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0.0"
},
{
"status": "affected",
"version": "4.0.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MiniSeq Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "2.0 "
}
]
},
{
"defaultStatus": "unaffected",
"product": "iSeq 100",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MiSeq Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0 (RUO Mode)"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MiSeqDx Operating Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0.1 "
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 500/550 Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 550Dx Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0 (RUO Mode)"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 550Dx Operating Software",
"vendor": "Illumina ",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "1.0.0 ",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.3.3 "
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 1000/2000 Control Software",
"vendor": "Illumina ",
"versions": [
{
"lessThanOrEqual": "1.4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NovaSeq 6000 Control Software",
"vendor": "Illumina ",
"versions": [
{
"lessThanOrEqual": "1.7 ",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NovaSeq Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "1.8"
}
]
}
],
"credits": [
{
"lang": "en",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Illumina reported these vulnerabilities to CISA. "
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Instruments with Illumina Universal Copy Service v1.x and\nv2.x contain an unnecessary privileges vulnerability. An unauthenticated\nmalicious actor could upload and execute code remotely at the operating system\nlevel, which could allow an attacker to change settings, configurations,\nsoftware, or access sensitive data on the affected product.\n\n\n\n\n\n"
}
],
"value": "Instruments with Illumina Universal Copy Service v1.x and\nv2.x contain an unnecessary privileges vulnerability. An unauthenticated\nmalicious actor could upload and execute code remotely at the operating system\nlevel, which could allow an attacker to change settings, configurations,\nsoftware, or access sensitive data on the affected product.\n\n\n\n\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "PHYSICAL",
"availabilityImpact": "HIGH",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "CWE-250 Execution with Unnecessary Privileges",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-28T18:06:51.431Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "CVE-2023-1966",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIllumina recommends using the \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html\"\u003eUCS Vulnerability Instructions Guide\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;based on the user\u2019s specific system configuration to mitigate the vulnerabilities. Illumina recommends users read the instructions before downloading any software. \u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nIllumina recommends using the UCS Vulnerability Instructions Guide https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html \u00a0based on the user\u2019s specific system configuration to mitigate the vulnerabilities. Illumina recommends users read the instructions before downloading any software. \n\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-1966",
"datePublished": "2023-04-28T18:06:51.431Z",
"dateReserved": "2023-04-10T14:50:41.262Z",
"dateUpdated": "2025-01-16T21:35:30.057Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1519 (GCVE-0-2022-1519)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2025-04-16 16:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-434 - Unrestricted Upload of File with Dangerous Type
Summary
LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | NextSeq 550Dx |
Version: LRM Versions 1.3 to 3.1 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:10:03.403Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-1519",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:54:29.024230Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:17:02.637Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NextSeq 550Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 500 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 550 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "iSeq 100 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiniSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
}
],
"datePublic": "2022-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-434",
"description": "CWE-434 Unrestricted Upload of File with Dangerous Type",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:13.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220602T06:00:00.000000Z",
"ID": "CVE-2022-1519",
"STATE": "PUBLIC",
"TITLE": ""
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 500 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "iSeq 100 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiniSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-434 Unrestricted Upload of File with Dangerous Type"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1519",
"datePublished": "2022-06-24T15:00:13.721Z",
"dateReserved": "2022-04-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:17:02.637Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-1968 (GCVE-0-2023-1968)
Vulnerability from cvelistv5
Published
2023-04-28 18:09
Modified
2025-01-16 21:35
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-1327 - Binding to an Unrestricted IP Address
Summary
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
References
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | iScan Control Software |
Version: 4.0.0 Version: 4.0.5 |
|||||||||||||||||||||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:05:27.076Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
},
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-1968",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-16T20:58:25.534437Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-16T21:35:22.697Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "iScan Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0.0"
},
{
"status": "affected",
"version": "4.0.5"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MiniSeq Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "2.0 "
}
]
},
{
"defaultStatus": "unaffected",
"product": "iSeq 100",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "All versions"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MiSeq Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0 (RUO Mode)"
}
]
},
{
"defaultStatus": "unaffected",
"product": "MiSeqDx Operating Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0.1 "
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 500/550 Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 550Dx Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "4.0 (RUO Mode)"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 550Dx Operating Software",
"vendor": "Illumina ",
"versions": [
{
"lessThanOrEqual": "1.3.1",
"status": "affected",
"version": "1.0.0 ",
"versionType": "custom"
},
{
"status": "affected",
"version": "1.3.3 "
}
]
},
{
"defaultStatus": "unaffected",
"product": "NextSeq 1000/2000 Control Software",
"vendor": "Illumina ",
"versions": [
{
"lessThanOrEqual": "1.4.1",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NovaSeq 6000 Control Software",
"vendor": "Illumina ",
"versions": [
{
"lessThanOrEqual": "1.7 ",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"defaultStatus": "unaffected",
"product": "NovaSeq Control Software",
"vendor": "Illumina ",
"versions": [
{
"status": "affected",
"version": "1.8"
}
]
}
],
"credits": [
{
"lang": "en",
"user": "00000000-0000-4000-9000-000000000000",
"value": "Illumina reported these vulnerabilities to CISA. "
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eInstruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. \u003c/span\u003e\n\n\n\n\n\n\n\n"
}
],
"value": "\nInstruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. \n\n\n\n\n\n\n\n"
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-1327",
"description": "CWE-1327 Binding to an Unrestricted IP Address",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-28T18:09:17.372Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html"
}
],
"source": {
"discovery": "INTERNAL"
},
"title": "CVE-2023-1968",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIllumina recommends using the \u003c/span\u003e\u003ca target=\"_blank\" rel=\"nofollow\" href=\"https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html\"\u003eUCS Vulnerability Instructions Guide\u003c/a\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;based on the user\u2019s specific system configuration to mitigate the vulnerabilities. Illumina recommends users read the instructions before downloading any software. \u003c/span\u003e\n\n\u003cbr\u003e"
}
],
"value": "\nIllumina recommends using the UCS Vulnerability Instructions Guide https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html \u00a0based on the user\u2019s specific system configuration to mitigate the vulnerabilities. Illumina recommends users read the instructions before downloading any software. \n\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2023-1968",
"datePublished": "2023-04-28T18:09:17.372Z",
"dateReserved": "2023-04-10T14:51:29.181Z",
"dateUpdated": "2025-01-16T21:35:22.697Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1518 (GCVE-0-2022-1518)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2025-04-16 16:16
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Summary
LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | NextSeq 550Dx |
Version: LRM Versions 1.3 to 3.1 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:10:02.827Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-1518",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:54:25.332039Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:16:54.839Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NextSeq 550Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 500 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 550 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "iSeq 100 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiniSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
}
],
"datePublic": "2022-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:14.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY (\u0027PATH TRAVERSAL\u0027) CWE-22",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220602T06:00:00.000000Z",
"ID": "CVE-2022-1518",
"STATE": "PUBLIC",
"TITLE": "3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY (\u0027PATH TRAVERSAL\u0027) CWE-22"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 500 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "iSeq 100 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiniSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1518",
"datePublished": "2022-06-24T15:00:14.741Z",
"dateReserved": "2022-04-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:16:54.839Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1517 (GCVE-0-2022-1517)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2025-04-16 16:17
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-250 - cwe-250
Summary
LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | NextSeq 550Dx |
Version: LRM Versions 1.3 to 3.1 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:10:02.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-1517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:54:32.128012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:17:11.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NextSeq 550Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 500 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 550 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "iSeq 100 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiniSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
}
],
"datePublic": "2022-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "cwe-250",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:12.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220602T06:00:00.000000Z",
"ID": "CVE-2022-1517",
"STATE": "PUBLIC",
"TITLE": "3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 500 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "iSeq 100 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiniSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "cwe-250"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1517",
"datePublished": "2022-06-24T15:00:12.934Z",
"dateReserved": "2022-04-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:17:11.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-1524 (GCVE-0-2022-1524)
Vulnerability from cvelistv5
Published
2022-06-24 15:00
Modified
2025-04-16 17:52
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-319 - Cleartext Transmission of Sensitive Information
Summary
LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
References
| ► | URL | Tags | |||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| ► | Illumina | NextSeq 550Dx |
Version: LRM Versions 1.3 to 3.1 |
|||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:10:03.321Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-1524",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T17:28:35.654447Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T17:52:17.725Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NextSeq 550Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 500 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 550 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "iSeq 100 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiniSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
}
],
"datePublic": "2022-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-319",
"description": "CWE-319 Cleartext Transmission of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:16.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220602T06:00:00.000000Z",
"ID": "CVE-2022-1524",
"STATE": "PUBLIC",
"TITLE": "3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 500 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "iSeq 100 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiniSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-319 Cleartext Transmission of Sensitive Information"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1524",
"datePublished": "2022-06-24T15:00:16.330Z",
"dateReserved": "2022-04-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T17:52:17.725Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}