CVE-2022-1517: critical vulnerability in Illumina iSeq 100 Instrument
3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 1.8%
LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Illumina · iSeq 100 InstrumentIllumina · MiniSeq InstrumentIllumina · MiSeq DxIllumina · MiSeq InstrumentIllumina · NextSeq 500 InstrumentIllumina · NextSeq 550DxIllumina · NextSeq 550 InstrumentRelated CVEs — Illumina iSeq 100 Instrument
In the same product, most dangerous first.
CVE-2022-1518CRITICAL3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22EPSS 1.7%CVE-2022-1519CRITICALCVE-2022-1519EPSS 1.4%CVE-2022-1521CRITICAL3.2.4 IMPROPER ACCESS CONTROL CWE-284EPSS 1.1%CVE-2022-1524HIGH3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319EPSS 0.3%