by Kastro
Paper/Archive/CVE-2022-1517

CVE-2022-1517

Illumina NextSeq 550Dx — 3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250

EPSS 2%CVSS 10.0
critical.is priorityof 100
46
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 78.8.788 × 2015.8No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.

Affected

ProductAffectedFixed inSource
NextSeq 550DxLRM Versions 1.3 to 3.1–CNA
MiSeq DxLRM Versions 1.3 to 3.1–CNA
NextSeq 500 InstrumentLRM Versions 1.3 to 3.1–CNA
NextSeq 550 InstrumentLRM Versions 1.3 to 3.1–CNA
MiSeq InstrumentLRM Versions 1.3 to 3.1–CNA
iSeq 100 InstrumentLRM Versions 1.3 to 3.1–CNA
MiniSeq InstrumentLRM Versions 1.3 to 3.1–CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-153-02