Vulnerability · Published Jun 24, 2022 · Assigned by icscert

CVE-2022-15173.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250

Critical 10.0

In plain English

A critical-severity security flaw in iSeq 100 Instrument from Illumina. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.8% (higher than 79% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)1.8%top 21.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.

Affected products (as reported)

Vendor	Product	Versions
Illumina	NextSeq 550Dx	LRM Versions 1.3 to 3.1
Illumina	MiSeq Dx	LRM Versions 1.3 to 3.1
Illumina	NextSeq 500 Instrument	LRM Versions 1.3 to 3.1
Illumina	NextSeq 550 Instrument	LRM Versions 1.3 to 3.1
Illumina	MiSeq Instrument	LRM Versions 1.3 to 3.1
Illumina	iSeq 100 Instrument	LRM Versions 1.3 to 3.1
Illumina	MiniSeq Instrument	LRM Versions 1.3 to 3.1

Weakness: CWE-250 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02 x_refsource_MISC