CVE-2022-1524 3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319
Attackers can intercept sensitive data, including credentials, via man-in-the-middle attacks due to lack of TLS encryption in Illumina sequencing instruments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-1524?
CVE-2022-1524 is a high-severity vulnerability in Illumina MiSeq Dx, published on 24 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.
Weakness: CWE-319
Which versions are affected by CVE-2022-1524?
It affects 1 product.
Products include Illumina Local Run Manager.
How do I fix CVE-2022-1524?
No fix has been published for CVE-2022-1524 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-1524 being exploited?
There is no known exploitation of CVE-2022-1524 in the wild and no public exploit code.
Other vulnerabilities in Illumina MiSeq Dx
Sources
Also known as GHSA-qqpc-gc88-ff86.