Critical ICSA-22-153-02 5 CVEs

Illumina Local Run Manager

Published Jun 2, 2022 · Updated Aug 23, 2022 · Revision 3

Vendor: Illumina Product: iSeq 100 Instrument LRM Product: MiniSeq Instrument LRM Product: MiSeq Dx LRM Product: MiSeq Instrument LRM Product: NextSeq 500 Instrument LRM Product: NextSeq 550 Instrument LRM Product: NextSeq 550Dx LRM

Summary

Successful exploitation of these vulnerabilities may allow an unauthenticated malicious actor to take control of the affected product remotely and take any action at the operating system level. An attacker could impact settings, configurations, software, or data on the affected product and interact through the affected product with the connected network..

Vulnerabilities 5

Critical 10.0

CVE-2022-1517

3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc.…

Illumina MiniSeq Instrument MiSeq Dx NextSeq 550 Instrument

Jun 24, 2022
Critical 10.0

CVE-2022-1518

3.2.2 IMPROPER LIMITATION OF A PATHNAME TO A RESTRICTED DIRECTORY ('PATH TRAVERSAL') CWE-22

LRM contains a directory traversal vulnerability that can allow a malicious actor to upload outside the intended directory structure.

Illumina MiniSeq Instrument MiSeq Dx NextSeq 550 Instrument

Jun 24, 2022
Critical 10.0

CVE-2022-1519

LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any…

Illumina MiniSeq Instrument MiSeq Dx NextSeq 550 Instrument

Jun 24, 2022
Critical 9.1

CVE-2022-1521

3.2.4 IMPROPER ACCESS CONTROL CWE-284

LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.

Illumina MiniSeq Instrument NextSeq 550Dx NextSeq 550 Instrument

Jun 24, 2022
High 7.4

CVE-2022-1524

3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319

LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.

Illumina iSeq 100 Instrument NextSeq 550Dx MiSeq Instrument

Jun 24, 2022

Revision history

2022-08-23 #3
Illumina Local Run Manager (Update B)
2022-06-22 #2
Illumina Local Run Manager (Update A)
2022-06-02 #1
ICSA-22-153-02 Illumina Local Run Manager

References

ICS Advisory ICSA-22-153-02 Web Version
https://www.cisa.gov/news-events/ics-advisories/icsa-22-153-02
Recommended Practices
https://www.cisa.gov/uscert/ics/alerts/ICS-ALERT-10-301-01
Recommended Practices
https://www.cisa.gov/uscert/sites/default/files/recommended_practices/NCCIC_ICS-CERT_Defense_in_Depth_2016_S508C.pdf
Recommended Practices
https://www.cisa.gov/uscert/ics/tips/ICS-TIP-12-146-01B