CVE-2023-1968 CVE-2023-1968
Unauthenticated attackers can access Illumina sequencing instruments via the Universal Copy Service due to unrestricted IP binding, bypassing network isolation controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-1968?
CVE-2023-1968 is a critical vulnerability in Illumina MiSeq Control Software, published on 28 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.
Weakness: CWE-1327
Which versions are affected by CVE-2023-1968?
It affects 11 products.
Products include Illumina Iscan Firmware, Illumina Iseq 100 Firmware, Illumina Miniseq Firmware, Illumina Miseq Firmware, Illumina Miseqdx Firmware, Illumina Nextseq 1000 Firmware and 5 more.
How do I fix CVE-2023-1968?
No fix has been published for CVE-2023-1968 yet. Limit exposure of the affected software until one is available.
Is CVE-2023-1968 being exploited?
There is no known exploitation of CVE-2023-1968 in the wild and no public exploit code.
Other vulnerabilities in Illumina MiSeq Control Software
Sources
Also known as GHSA-cpwh-2ghx-4jvr.