CVE-2023-1968criticalCWE-1327

CVE-2023-1968: critical vulnerability in Illumina iScan Control Software

CVE-2023-1968

Published · Updated

Follow this CVE+ Monitor iScan Control+ Monitor iSeq

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 10epss 1.8%
In short

Illumina instruments running Universal Copy Service v2.x listen on all network addresses without restriction, allowing anyone on the network to connect and potentially compromise the system without needing a password.

Technical detail

CWE-1327 involves binding to an unrestricted IP address (0.0.0.0 or ::), exposing UCS v2.x to unauthenticated network access. An attacker on the same network or with routing to the instrument can interact with the service directly, bypassing authentication mechanisms and gaining control over sensitive medical imaging operations.

Summary generated and translated by AI from the official description.
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Illumina · iScan Control SoftwareIllumina · iSeq 100Illumina · MiniSeq Control SoftwareIllumina · MiSeq Control SoftwareIllumina · MiSeqDx Operating SoftwareIllumina · NextSeq 1000/2000 Control SoftwareIllumina · NextSeq 500/550 Control SoftwareIllumina · NextSeq 550Dx Control SoftwareIllumina · NextSeq 550Dx Operating SoftwareIllumina · NovaSeq 6000 Control SoftwareIllumina · NovaSeq Control Software
Related CVEs — Illumina iScan Control Software

In the same product, most dangerous first.

CVE-2023-1966HIGHCVE-2023-1966EPSS 0.9%