An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. They run an SSH server accessible over the default port 22. The root account has a weak default password of ionadmin, and a password change policy for the root account is not enforced. Thus, an attacker with network connectivity can achieve root code execution. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
References
Configurations
Configuration 1 (hide)
| AND |
|
History
16 Dec 2025, 21:01
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:thermofisher:ion_torrent_onetouch_2_firmware:-:*:*:*:*:*:*:* cpe:2.3:h:thermofisher:ion_torrent_onetouch_2:-:*:*:*:*:*:*:* |
|
| First Time |
Thermofisher
Thermofisher ion Torrent Onetouch 2 Firmware Thermofisher ion Torrent Onetouch 2 |
|
| References | () https://assets.thermofisher.com/TFS-Assets/LSG/manuals/MAN0014388_IonOneTouch2Sys_UG.pdf - Product | |
| References | () https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf - Vendor Advisory | |
| References | () https://tools.thermofisher.cn/content/sfs/brochures/One_Touch_2_Spec_Sheet.pdf - Permissions Required |
05 Dec 2025, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-521 | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
04 Dec 2025, 15:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-12-04 15:15
Updated : 2025-12-16 21:01
NVD link : CVE-2025-53963
Mitre link : CVE-2025-53963
CVE.ORG link : CVE-2025-53963
JSON object : View
Products Affected
thermofisher
- ion_torrent_onetouch_2_firmware
- ion_torrent_onetouch_2
CWE
CWE-521
Weak Password Requirements