CVE-2023-1966

Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 0.7 / Impact : 6.0

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html	Vendor Advisory
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01	Third Party Advisory US Government Resource
https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html	Vendor Advisory
https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01	Third Party Advisory US Government Resource

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:o:illumina:iscan_firmware:4.0.0:::::::*
	cpe:2.3:o:illumina:iscan_firmware:4.0.5:::::::*

cpe:2.3:h:illumina:iscan:-:*:*:*:*:*:*:*

Configuration 2 (hide)

AND

cpe:2.3:o:illumina:iseq_100_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*

Configuration 3 (hide)

AND

cpe:2.3:o:illumina:miniseq_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND

cpe:2.3:o:illumina:miseq_firmware:*:*:*:*:*:*:*:*

cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND

OR	cpe:2.3:o:illumina:miseqdx_firmware:::::-:::*
	cpe:2.3:o:illumina:miseqdx_firmware:4.0::::ruo:::

cpe:2.3:h:illumina:miseqdx:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND

cpe:2.3:o:illumina:nextseq_500_firmware:4.0:*:*:*:*:*:*:*

cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND

cpe:2.3:o:illumina:nextseq_550_firmware:4.0:*:*:*:*:*:*:*

cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND

OR	cpe:2.3:o:illumina:nextseq_550dx_firmware:::::-:::*
	cpe:2.3:o:illumina:nextseq_550dx_firmware:::::-:::*
	cpe:2.3:o:illumina:nextseq_550dx_firmware:4.0::::ruo:::

cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND

cpe:2.3:o:illumina:nextseq_1000_firmware:1.4.1:*:*:*:*:*:*:*

cpe:2.3:h:illumina:nextseq_1000:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND

cpe:2.3:o:illumina:nextseq_2000_firmware:1.4.1:*:*:*:*:*:*:*

cpe:2.3:h:illumina:nextseq_2000:-:*:*:*:*:*:*:*

Configuration 11 (hide)

AND

OR	cpe:2.3:o:illumina:novaseq_6000_firmware::::::::
	cpe:2.3:o:illumina:novaseq_6000_firmware:1.8:::::::*

cpe:2.3:h:illumina:novaseq_6000:-:*:*:*:*:*:*:*

History

21 Nov 2024, 07:40

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~9.8~~	v2 : unknown v3 : 7.4
References	~~() https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html - Vendor Advisory~~	() https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html - Vendor Advisory
References	~~() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 - Third Party Advisory, US Government Resource~~	() https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 - Third Party Advisory, US Government Resource

09 May 2023, 17:53

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : unknown v3 : 9.8
First Time		Illumina nextseq 500 Firmware Illumina miseqdx Illumina nextseq 1000 Firmware Illumina iseq 100 Firmware Illumina nextseq 550dx Firmware Illumina nextseq 550 Illumina iseq 100 Illumina miniseq Illumina iscan Firmware Illumina novaseq 6000 Firmware Illumina miniseq Firmware Illumina nextseq 1000 Illumina miseq Illumina nextseq 550 Firmware Illumina miseqdx Firmware Illumina nextseq 500 Illumina miseq Firmware Illumina Illumina iscan Illumina nextseq 550dx Illumina nextseq 2000 Illumina novaseq 6000 Illumina nextseq 2000 Firmware
CWE		CWE-269
References	~~(MISC) https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html -~~	(MISC) https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html - Vendor Advisory
References	~~(MISC) https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 -~~	(MISC) https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 - Third Party Advisory, US Government Resource
CPE		cpe:2.3:h:illumina:nextseq_2000:-:::::::* cpe:2.3:o:illumina:miseqdx_firmware:::::-:::* cpe:2.3:o:illumina:miseqdx_firmware:4.0::::ruo::: cpe:2.3:o:illumina:nextseq_550dx_firmware:::::-:::* cpe:2.3:h:illumina:iscan:-:::::::* cpe:2.3:o:illumina:nextseq_550_firmware:4.0:::::::* cpe:2.3:o:illumina:iscan_firmware:4.0.0:::::::* cpe:2.3:h:illumina:nextseq_1000:-:::::::* cpe:2.3:h:illumina:nextseq_550:-:::::::* cpe:2.3:o:illumina:miseq_firmware:::::::: cpe:2.3:o:illumina:iscan_firmware:4.0.5:::::::* cpe:2.3:o:illumina:novaseq_6000_firmware:1.8:::::::* cpe:2.3:h:illumina:miniseq:-:::::::* cpe:2.3:o:illumina:iseq_100_firmware:::::::: cpe:2.3:o:illumina:nextseq_550dx_firmware:4.0::::ruo::: cpe:2.3:o:illumina:miniseq_firmware:::::::: cpe:2.3:h:illumina:novaseq_6000:-:::::::* cpe:2.3:h:illumina:miseq:-:::::::* cpe:2.3:h:illumina:miseqdx:-:::::::* cpe:2.3:o:illumina:nextseq_1000_firmware:1.4.1:::::::* cpe:2.3:h:illumina:nextseq_550dx:-:::::::* cpe:2.3:o:illumina:nextseq_500_firmware:4.0:::::::* cpe:2.3:h:illumina:nextseq_500:-:::::::* cpe:2.3:o:illumina:nextseq_2000_firmware:1.4.1:::::::* cpe:2.3:h:illumina:iseq_100:-:::::::* cpe:2.3:o:illumina:novaseq_6000_firmware::::::::

28 Apr 2023, 19:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2023-04-28 19:15

Updated : 2024-11-21 07:40

NVD link : CVE-2023-1966

Mitre link : CVE-2023-1966

CVE.ORG link : CVE-2023-1966

JSON object : View

Products Affected

illumina

iscan_firmware
miniseq
miseq_firmware
novaseq_6000
nextseq_550dx_firmware
nextseq_550
nextseq_550dx
nextseq_500_firmware
nextseq_1000_firmware
novaseq_6000_firmware
miniseq_firmware
miseqdx
nextseq_500
miseqdx_firmware
nextseq_2000_firmware
iseq_100
iseq_100_firmware
iscan
nextseq_1000
nextseq_550_firmware
nextseq_2000
miseq

CWE

CWE-250

Execution with Unnecessary Privileges

CWE-269

Improper Privilege Management

{"id": "CVE-2023-1966", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 0.7}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "published": "2023-04-28T19:15:16.573", "references": [{"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html", "tags": ["Vendor Advisory"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "ics-cert@hq.dhs.gov"}, {"url": "https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01", "tags": ["Third Party Advisory", "US Government Resource"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "ics-cert@hq.dhs.gov", "description": [{"lang": "en", "value": "CWE-250"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "Instruments with Illumina Universal Copy Service v1.x and\nv2.x contain an unnecessary privileges vulnerability. An unauthenticated\nmalicious actor could upload and execute code remotely at the operating system\nlevel, which could allow an attacker to change settings, configurations,\nsoftware, or access sensitive data on the affected product.\n\n\n\n\n\n"}], "lastModified": "2024-11-21T07:40:14.730", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:iscan_firmware:4.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B5000279-D40B-4526-B911-9E0641736EE1"}, {"criteria": "cpe:2.3:o:illumina:iscan_firmware:4.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD7BE281-02B5-4B87-A7E2-D0E3BB5309CF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:iscan:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "08732A94-734B-486E-AB2C-A2E2CA3C66AE"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:iseq_100_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D22304CE-8F36-4B51-BAA2-E2C564C04CDF"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:miniseq_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4B7C1F7-D185-4C72-B23C-A21103267CD6", "versionStartIncluding": "2.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:miseq_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CC028805-6ED3-455B-8F4C-95A8B8C5E756", "versionStartIncluding": "4.0"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:miseqdx_firmware:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "E97A49E3-4B87-4FE5-8FD4-5B36C61A0650", "versionStartIncluding": "4.0.1"}, {"criteria": "cpe:2.3:o:illumina:miseqdx_firmware:4.0:*:*:*:ruo:*:*:*", "vulnerable": true, "matchCriteriaId": "BE1CBD4E-42B1-42C6-9B3F-4F715A5DBF6D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:miseqdx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "CBD56D9E-B16C-4ED4-A2E4-E73A3A9A599B"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:nextseq_500_firmware:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22E34BB5-591C-4889-851E-9A66212C8B8C"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:nextseq_550_firmware:4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D0D02B5D-7E8A-41CD-BE27-5B012BE5C016"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "93DC004D-271D-4075-9828-E88CD7FFC403", "versionEndIncluding": "1.3.1", "versionStartIncluding": "1.0.0"}, {"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:*:*:*:*:-:*:*:*", "vulnerable": true, "matchCriteriaId": "E199B789-BF31-40AC-B15E-31A97257002B", "versionStartIncluding": "1.3.3"}, {"criteria": "cpe:2.3:o:illumina:nextseq_550dx_firmware:4.0:*:*:*:ruo:*:*:*", "vulnerable": true, "matchCriteriaId": "78D581A6-38A5-4F0A-A5CB-B25A9337EE78"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:nextseq_1000_firmware:1.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94B82675-AA38-4584-82BD-9C376F80EA49"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:nextseq_1000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "93589C3C-F577-4C67-962F-166E28911ED2"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:nextseq_2000_firmware:1.4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6671E6F8-85D5-4970-98FE-6189C8F98852"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:nextseq_2000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "753D8FDF-5D25-46B9-8E66-30FB8E8A9A87"}], "operator": "OR"}], "operator": "AND"}, {"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:illumina:novaseq_6000_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3A429D26-AF22-4AC2-AB02-76C72B9B9B05", "versionEndIncluding": "1.7"}, {"criteria": "cpe:2.3:o:illumina:novaseq_6000_firmware:1.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B4C702B1-4BAD-4E32-9659-D9F5C3F2F922"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:illumina:novaseq_6000:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "0D879686-89E7-4152-AEF9-DC8A33FDA4A5"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ics-cert@hq.dhs.gov"}

7.4 /10