VulnerabilityModified
CVE-2023-1966
Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability.
CRITICAL 9.8EPSS 0.92%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.92%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product.
- CVSS 3.1
- 9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.92% probability · 58th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-250, CWE-269
- Affected
- illumina/iscan firmware · illumina/iseq 100 firmware · illumina/miniseq firmware · illumina/miseq firmware · illumina/miseqdx firmware · illumina/nextseq 500 firmware · illumina/nextseq 550 firmware · illumina/nextseq 550dx firmware · illumina/nextseq 1000 firmware · illumina/nextseq 2000 firmware · illumina/novaseq 6000 firmware
- Source
- ics-cert@hq.dhs.gov
References
- https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.htmlVendor Advisory
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01Third Party Advisory, US Government Resource
- https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.htmlVendor Advisory
- https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01Third Party Advisory, US Government Resource
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.