The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has released an Industrial Control Systems (ICS) medical advisory warning of vulnerabilities that could allow an attacker to take any action at the operating system level.
The issues impact the following products using the Illumina Universal Copy Service:
The above medical devices are used either in clinical diagnostic use in sequencing a person’s DNA for various genetic conditions or for research use only (RUO).
“Successful exploitation of these vulnerabilities could allow an attacker to take any action at the operating system level. A threat actor could impact settings, configurations, software, or data on the affected product; a threat actor could interact through the affected product via a connected network.” reads the Industrial Control Systems Medical Advisory published by CISA.
The most severe of the vulnerabilities, tracked as CVE-2023-1968 (CVSS score: 10.0), allows an unauthenticated, remote attacker to bind to an unrestricted IP address. An attacker could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
A remote attacker can potentially eavesdrop on network traffic and inject arbitrary commands.
The second issue reported in the advisory, tracked as CVE-2023-1966 (CVSS score: 7.4), is an unnecessary privileges vulnerability.
“An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product.” continues the advisory.
The Food and Drug Administration (FDA) also published an advisory that remarks that an unauthorized attacker can exploit the first vulnerability by:
“At this time, the FDA and Illumina have not received any reports indicating this vulnerability has been exploited.” reads the alert published by FDA. “llumina developed a software patch to protect against the exploitation of this vulnerability. The FDA wants health care providers and laboratory personnel to be aware of the required actions to mitigate these cybersecurity risks.”
The good news is that there is no evidence that the two vulnerabilities have been exploited in the wild.
The company urges customers to install the security updates released on April 5, 2023.
Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections:
Please nominate Security Affairs as your favorite blog.
Nominate here: https://docs.google.com/forms/d/e/1FAIpQLSfaFMkrMlrLhOBsRPKdv56Y4HgC88Bcji4V7OCxCm_OmyPoLw/viewform
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, CISA)
MonsterCloud owner Zohar Pinhasi allegedly paid ransomware demands behind clients’ backs, then charged them millions…
The U.S. offers $10M for Zhang Yu, accused of helping run HAFNIUM attacks that compromised…
Threat actors are exploiting CVE-2026-21589, a critical Atlassian flaw that can expose sensitive files across…
SonicWall patched a CVSS 10 pre-auth SSRF flaw in SMA1000 appliances that could let unauthenticated…
FBI and Secret Service warn FortiBleed, a credential-harvesting campaign against Fortinet firewalls, has compromised 86,644…
Over 100 hacked websites used fake Cloudflare checks to trick visitors into installing LunexStealer through…
This website uses cookies.