Common Copy Service, a software program suite utilized by medical laboratories internationally for DNA sequencing, carries two high-severity vulnerabilities that might permit menace actors to completely take over the focused endpoints and exfiltrate delicate information.
A joint safety advisory from the US Cybersecurity Infrastructure Safety Company (CISA) and the FDA has urged customers to patch the software program as quickly as doable.
“An unauthenticated malicious actor might add and execute code remotely on the working system stage, which might permit an attacker to vary settings, configurations, software program, or entry delicate information on the affected product,” CISA’s warning reads.
Delicate information
Common Copy Service, developed by a California-based medical know-how firm referred to as Illumina, is among the hottest DNA sequencing instruments on the planet. Analysis organizations, tutorial establishments, biotechnology companies and pharma corporations (opens in new tab) in 140 nations regularly use this system, the publication says.
“On April 5, 2023, Illumina despatched notifications to affected prospects instructing them to examine their devices and medical gadgets for indicators of potential exploitation of the vulnerability,” the FDA added.
As per the report, the 2 vulnerabilities are tracked as CVE-2023-1968, and CVE-2023-1966. The previous is a ten/10, “essential” vulnerability that enables menace actors to pay attention to all community visitors, consequently discovering extra susceptible hosts on the community. Hackers might use it to ship instructions to the software program, tweak settings, and even entry delicate information, the researchers mentioned. The latter, however, is a 7.4/10, “excessive” severity vulnerability, permitting UCS customers to run instructions with elevated privileges.
Because the vulnerabilities affect a number of Illumina merchandise, there are totally different units of mitigation measures, relying on the software program in query. Illumina recommends doing various things, from updating system software program, to configuring UCS account credentials, to closing particular firewall ports that may be abused.
The complete checklist of susceptible merchandise might be discovered on this link (opens in new tab).
Through: BleepingComputer (opens in new tab)
