PT-2023-2562 · Illumina · Illumina Universal Copy Service

Publicado 2023-04-27 · Atualizado 2023-05-09 · CVE-2023-1966

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Illumina Universal Copy Service versions v1.x through v2.x

Description The issue is related to unnecessary privileges in the Illumina Universal Copy Service, which could allow an unauthenticated malicious actor to upload and execute code remotely at the operating system level. This could enable an attacker to change settings, configurations, software, or access sensitive data on the affected product. The vulnerability is also associated with errors in managing privileges, potentially allowing a remote attacker to disclose protected information and upload or execute code with elevated privileges.

Recommendations For Illumina Universal Copy Service versions v1.x through v2.x, consider disabling remote code execution capabilities until a patch is available. Restrict access to sensitive data and configurations to minimize the risk of exploitation. Avoid using the service for uploading or executing code from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Enumeração de Fraquezas

CWE-250

CWE-269

Identificadores relacionados

BDU:2023-02377

CVE-2023-1966

Produtos afetados

Illumina Universal Copy Service

Referências · 7

• https://bdu.fstec.ru/vul/2023-02377 · Nota de Segurança
• https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html · Aviso do Fabricante
• https://cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1966 · Nota de Segurança
• https://t.me/cvenotify/49350 · Publicação no Telegram
• https://securitylab.ru/news/537899.php · Nota
• https://osv.dev/vulnerability/CVE-2023-1966 · Aviso do Fabricante