by Kastro
Paper/Archive/CVE-2023-1968

CVE-2023-1968

Illumina iScan Control Software — CVE-2023-1968

EPSS 2%CVSS 10.0
critical.is priorityof 100
46
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 78.6.786 × 2015.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.

Affected

ProductAffectedFixed inSource
iScan Control Software4.0.0–CNA
iScan Control Software4.0.5–CNA
MiniSeq Control Software2.0 –CNA
iSeq 100All versions–CNA
MiSeq Control Software4.0 (RUO Mode)–CNA
MiSeqDx Operating Software4.0.1 –CNA
NextSeq 500/550 Control Software4.0–CNA
NextSeq 550Dx Control Software4.0 (RUO Mode)–CNA
NextSeq 550Dx Operating Software1.0.0 – 1.3.1–CNA
NextSeq 550Dx Operating Software1.3.3 –CNA
NextSeq 1000/2000 Control Software≤ 1.4.1–CNA
NovaSeq 6000 Control Software≤ 1.7 –CNA

Scores by source

icscert (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcisa.gov/news-events/ics-medical-advisories/icsma-23-117-01advisorysupport.illumina.com/downloads/illumina-universal-copy-service-1-0.html