PT-2022-4354 · Illumina · Illumina Local Run Manager

Published 2022-06-24 · Updated 2022-07-01 · CVE-2022-1524

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Illumina Local Run Manager versions 2.4 and lower

Description The issue is related to the lack of TLS encryption in the implementation of protocols, allowing a malicious actor to perform a man-in-the-middle (MITM) attack on sensitive data in-transit, including credentials. This can compromise the confidentiality of protected information.

Recommendations For versions 2.4 and lower, consider disabling sensitive data transmission until a patch that implements TLS encryption is available. Restrict access to sensitive data to minimize the risk of exploitation. As a temporary workaround, avoid transmitting credentials or other sensitive information using the affected software until a fix is implemented.

Fix

Cleartext Transmission of Sensitive Information

Weakness Enumeration

CWE-319

Related Identifiers

BDU:2022-05214

CVE-2022-1524

Affected Products

Illumina Local Run Manager

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2022-1524 · Security Note
• https://bdu.fstec.ru/vul/2022-05214 · Security Note
• https://osv.dev/vulnerability/CVE-2022-1524 · Vendor Advisory
• https://t.me/cibsecurity/45100 · Telegram Post
• https://us-cert.gov/ics/advisories/icsa-22-153-02 · Note
• https://cisa.gov/uscert/ics/advisories/icsa-22-153-02 · Note
• https://t.me/cvenotify/32109 · Telegram Post