PT-2023-2564 · Illumina · Illumina Universal Copy Service

Published 2023-04-27 · Updated 2023-05-09 · CVE-2023-1968

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Illumina Universal Copy Service versions 2.x

Description The issue is related to the binding of Illumina Universal Copy Service to an unrestricted IP address, allowing an unauthenticated malicious actor to use the service to listen on all IP addresses, including those capable of accepting remote communications. This could potentially enable the actor to intercept and manipulate network traffic, as well as remotely transmit arbitrary commands. The estimated number of potentially affected devices worldwide is not specified. There are no known public exploits specifically targeting this issue, and there is no confirmation that the vulnerability has been exploited in real-world attacks.

Recommendations For Illumina Universal Copy Service version 2.x, update to a patched version to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable service to minimize the risk of exploitation. Avoid using the service for remote communications until the issue is resolved.

Fix

Weakness Enumeration

CWE-1327

Related Identifiers

BDU:2023-02379

CVE-2023-1968

Affected Products

Illumina Universal Copy Service

References · 8

• https://osv.dev/vulnerability/CVE-2023-1968 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1968 · Security Note
• https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02379 · Security Note
• https://t.me/echeloneyes/1488 · Telegram Post
• https://t.me/cvenotify/49349 · Telegram Post
• https://securitylab.ru/news/537899.php · Note
• https://cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01 · Note