PT-2025-49040 · Thermo Fisher+1 · Torrent Suite+1

Published 2025-12-04 · Updated 2025-12-09 · CVE-2025-54303

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Thermo Fisher Torrent Suite Django application version 5.18.1

Description The application uses weak default credentials that are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ionadmin. While the user guide recommends changing default credentials, a password change policy is not enforced, potentially leaving many deployments vulnerable to unauthorized access with administrative privileges.

Recommendations Change the default password for the ionadmin user account.

Fix

Weakness Enumeration

CWE-1392

Related Identifiers

CVE-2025-54303

Affected Products

Django

Torrent Suite

References · 9

• https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2_and_Torrent_Suite_Software.pdf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-54303 · Security Note
• https://osv.dev/vulnerability/CVE-2025-54303 · Vendor Advisory
• https://twitter.com/VulmonFeeds/status/1996615811910320131 · Twitter Post
• https://t.me/CVEtracker/38829 · Telegram Post
• https://twitter.com/CVEnew/status/1996600331010978132 · Twitter Post
• https://thermofisher.com/us/en/home/life-science/sequencing/next-generation-sequencing/ion-torrent-next-generation-sequencing-workflow/ion-torrent-next-generation-sequencing-data-analysis-workflow/ion-torrent-suite-software.html · Note
• https://twitter.com/cracbot/status/1998346936659890571 · Twitter Post
• https://assets.thermofisher.com/TFS-Assets/LSG/manuals/MAN0026163-Torrent-Suite-5.18-UG.pdf · Note