CVE-2022-1517: Illumina NextSeq 550Dx, заобикаляне на вход и права

Описание

Оригинално описание

LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.

Засегнати продукти

• Illumina NextSeq 550Dx: LRM Versions 1.3 to 3.1
• Illumina MiSeq Dx: LRM Versions 1.3 to 3.1
• Illumina NextSeq 500 Instrument: LRM Versions 1.3 to 3.1
• Illumina NextSeq 550 Instrument: LRM Versions 1.3 to 3.1
• Illumina MiSeq Instrument: LRM Versions 1.3 to 3.1
• Illumina iSeq 100 Instrument: LRM Versions 1.3 to 3.1
• Illumina MiniSeq Instrument: LRM Versions 1.3 to 3.1

Вид слабост

• CWE-250 Изпълнение с ненужни привилегии

История

Други уязвимости в Illumina NextSeq 550Dx

• 7.4CVE-2022-1524
• 9.1CVE-2022-1521
• 10.0CVE-2022-1518
• 10.0CVE-2022-1519

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2022-1517
• https://nvd.nist.gov/vuln/detail/CVE-2022-1517
• https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02