by Kastro
Paper/Archive/CVE-2023-1966

CVE-2023-1966

Illumina iScan Control Software — CVE-2023-1966

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
41
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 60.2.602 × 2012.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product.

Affected

ProductAffectedFixed inSource
iScan Control Software4.0.0–CNA
iScan Control Software4.0.5–CNA
MiniSeq Control Software2.0 –CNA
iSeq 100All versions–CNA
MiSeq Control Software4.0 (RUO Mode)–CNA
MiSeqDx Operating Software4.0.1 –CNA
NextSeq 500/550 Control Software4.0–CNA
NextSeq 550Dx Control Software4.0 (RUO Mode)–CNA
NextSeq 550Dx Operating Software1.0.0 – 1.3.1–CNA
NextSeq 550Dx Operating Software1.3.3 –CNA
NextSeq 1000/2000 Control Software≤ 1.4.1–CNA
NovaSeq 6000 Control Software≤ 1.7 –CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
icscert (CNA)7.4CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-23-117-01advisorysupport.illumina.com/downloads/illumina-universal-copy-service-1-0.html