CVE-2023-1968
Assigner: icscert
Published: 2023-04-28T18:09:17.372Z
State: PUBLISHED
affected: defaultStatus: unaffected
product: iScan Control Software
vendor: Illumina 
versions: status: affected
version: 4.0.0
status: affected
version: 4.0.5
defaultStatus: unaffected
product: MiniSeq Control Software
vendor: Illumina 
versions: status: affected
version: 2.0 
defaultStatus: unaffected
product: iSeq 100
vendor: Illumina 
versions: status: affected
version: All versions
defaultStatus: unaffected
product: MiSeq Control Software
vendor: Illumina 
versions: status: affected
version: 4.0 (RUO Mode)
defaultStatus: unaffected
product: MiSeqDx Operating Software
vendor: Illumina 
versions: status: affected
version: 4.0.1 
defaultStatus: unaffected
product: NextSeq 500/550 Control Software
vendor: Illumina 
versions: status: affected
version: 4.0
defaultStatus: unaffected
product: NextSeq 550Dx Control Software
vendor: Illumina 
versions: status: affected
version: 4.0 (RUO Mode)
defaultStatus: unaffected
product: NextSeq 550Dx Operating Software
vendor: Illumina 
versions: lessThanOrEqual: 1.3.1
status: affected
version: 1.0.0 
versionType: custom
status: affected
version: 1.3.3 
defaultStatus: unaffected
product: NextSeq 1000/2000 Control Software
vendor: Illumina 
versions: lessThanOrEqual: 1.4.1
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: NovaSeq 6000 Control Software
vendor: Illumina 
versions: lessThanOrEqual: 1.7 
status: affected
version: 0
versionType: custom
defaultStatus: unaffected
product: NovaSeq Control Software
vendor: Illumina 
versions: status: affected
version: 1.8
credits: user: 00000000-0000-4000-9000-000000000000
value: Illumina reported these vulnerabilities to CISA. 
descriptions: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. </span>








value: 
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. 








metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
format: CVSS
scenarios: value: GENERAL
problemTypes: descriptions: cweId: CWE-1327
description: CWE-1327 Binding to an Unrestricted IP Address
type: CWE
source: discovery: INTERNAL
title: CVE-2023-1968
workarounds: supportingMedia: base64: no
type: text/html
value: 

<span style="background-color: rgb(255, 255, 255);">Illumina recommends using the </span><a target="_blank" rel="nofollow" href="https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html">UCS Vulnerability Instructions Guide</a><span style="background-color: rgb(255, 255, 255);">&nbsp;based on the user’s specific system configuration to mitigate the vulnerabilities. Illumina recommends users read the instructions before downloading any software. </span>

<br>
value: 
Illumina recommends using the  UCS Vulnerability Instructions Guide https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html  based on the user’s specific system configuration to mitigate the vulnerabilities. Illumina recommends users read the instructions before downloading any software. 



x_generator: engine: Vulnogram 0.1.0-dev