Pierluigi Paganini
April 29, 2023
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an Industrial Control Systems (ICS) medical advisory warning of vulnerabilities that could allow an attacker to take any action at the operating system level.
The issues impact the following products using the Illumina Universal Copy Service:
The above medical devices are used either in clinical diagnostic use in sequencing a person’s DNA for various genetic conditions or for research use only (RUO).
“Successful exploitation of these vulnerabilities could allow an attacker to take any action at the operating system level. A threat actor could impact settings, configurations, software, or data on the affected product; a threat actor could interact through the affected product via a connected network.” reads the Industrial Control Systems Medical Advisory published by CISA.
The most severe of the vulnerabilities, tracked as CVE-2023-1968 (CVSS score: 10.0), allows an unauthenticated, remote attacker to bind to an unrestricted IP address. An attacker could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
A remote attacker can potentially eavesdrop on network traffic and inject arbitrary commands.
The second issue reported in the advisory, tracked as CVE-2023-1966 (CVSS score: 7.4), is an unnecessary privileges vulnerability.
“An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product.” continues the advisory.
The Food and Drug Administration (FDA) also published an advisory that remarks that an unauthorized attacker can exploit the first vulnerability by:
“At this time, the FDA and Illumina have not received any reports indicating this vulnerability has been exploited.” reads the alert published by FDA. “llumina developed a software patch to protect against the exploitation of this vulnerability. The FDA wants health care providers and laboratory personnel to be aware of the required actions to mitigate these cybersecurity risks.”
The good news is that there is no evidence that the two vulnerabilities have been exploited in the wild.
The company urges customers to install the security updates released on April 5, 2023.
Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:
Please nominate Security Affairs as your favorite blog.
Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
