by Kastro
Paper/Archive/CVE-2022-1518

CVE-2022-1518

Illumina NextSeq 550Dx — 3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

EPSS 2%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 76.8.768 × 2015.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.

Affected

ProductAffectedFixed inSource
NextSeq 550DxLRM Versions 1.3 to 3.1–CNA
MiSeq DxLRM Versions 1.3 to 3.1–CNA
NextSeq 500 InstrumentLRM Versions 1.3 to 3.1–CNA
NextSeq 550 InstrumentLRM Versions 1.3 to 3.1–CNA
MiSeq InstrumentLRM Versions 1.3 to 3.1–CNA
iSeq 100 InstrumentLRM Versions 1.3 to 3.1–CNA
MiniSeq InstrumentLRM Versions 1.3 to 3.1–CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/uscert/ics/advisories/icsa-22-153-02