Vulnerability

Illumina Universal Copy Service on sequencers binds to every IP address and runs with excess privileges

MedDevice Cyber Staff · Apr 27 · 3 min read · Via CISA ICSMA-23-117-01

CISA published advisory ICSMA-23-117-01 on April 27, 2023, for the Universal Copy Service (UCS) that ships on Illumina instruments. Illumina reported the vulnerabilities.

CVE-2023-1968 (CWE-1327) scores CVSS v3 10.0. Instruments with UCS v2.x bind to an unrestricted IP address, so an unauthenticated actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications. CVE-2023-1966 (CWE-250, CVSS 7.4) affects UCS v1.x and v2.x: the service runs with unnecessary privileges, and an unauthenticated actor could upload and execute code at the operating system level.

Affected software includes MiSeq Control Software 4.0, MiSeqDx Operating Software 4.0.1 and later, MiniSeq Control Software 2.0 and later, NextSeq 1000/2000 Control Software 1.4.1 and earlier, NextSeq 500/550 and 550Dx Control Software 4.0, NextSeq 550Dx Operating Software, NovaSeq 6000 Control Software 1.7 and earlier, NovaSeq Control Software 1.8, iScan Control Software 4.0.0 and 4.0.5, and all versions on the iSeq 100.

CISA says an attacker could take any action at the operating system level and change settings, configurations, software or data on the instrument through a connected network. Some of those instruments are diagnostic, so the data at stake can include clinical results.

Illumina points users to its UCS Vulnerability Instructions Guide, matched to each system's configuration, and asks them to read it before downloading any software.

A file copy helper is the kind of service nobody inventories. It still listens on the network, and running it with unnecessary privileges turned a convenience into the instrument's largest attack surface.

Are you a representative of Illumina? Submit an official response →

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

Apply Illumina's UCS Vulnerability Instructions Guide for each instrument's configuration; read it before downloading any software. Until done, keep sequencers off networks that untrusted hosts can reach, since UCS listens on all IP addresses without authentication.

Follow the UCS guide. Apply the Illumina UCS Vulnerability Instructions Guide that matches each instrument's configuration.
Restrict instrument networks. Block inbound access to sequencers from anything but the hosts that need it.
Bind services narrowly. Bind helper services to the interfaces they need and run them with the least privilege that works.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the signals and properties below. Check them against your product to gauge exposure. The named product rows list what the sources state about the affected product.

Contributing

MiSeq

MiniSeq

NextSeq 1000/2000

NextSeq 500/550 and NextSeq 550Dx

NovaSeq

iScan

iSeq 100

Fix the class in your product

The product exposes an interface with authentication off out of the box. As the maker, make the default configuration the secure configuration: require an admin credential before any interface serves data, and refuse to expose anything until setup is complete.

Default to authenticated. Block every data path until an admin credential is set on first boot.
Make insecure mode explicit. If an open mode must exist, it is a loud, logged, opt in choice, never the starting state.
Test the out of box state. Treat the shipped default as its own threat model.

Mapped EMB3D mitigations

Questions & Answers

What is CVE-2023-1968 in the Illumina Universal Copy Service?

CVE-2023-1968 (CWE-1327, CVSS v3 10.0) means the Illumina Universal Copy Service v2.x binds to an unrestricted IP address, letting an unauthenticated actor listen on all IP addresses. CISA advisory ICSMA-23-117-01, published April 27, 2023, lists affected MiSeq, MiniSeq, NextSeq, NovaSeq, iScan and iSeq 100 software.

How do I fix the Illumina UCS vulnerabilities?

Illumina recommends following its UCS Vulnerability Instructions Guide for each system's configuration to mitigate CVE-2023-1968 and CVE-2023-1966, and reading the instructions before downloading any software, per CISA advisory ICSMA-23-117-01.

Which Illumina instruments are affected by CVE-2023-1966?

Instruments running Illumina Universal Copy Service v1.x or v2.x, including MiSeq, MiSeqDx, MiniSeq, NextSeq 500/550/550Dx, NextSeq 1000/2000, NovaSeq 6000, iScan and iSeq 100, are listed in CISA advisory ICSMA-23-117-01 for CVE-2023-1966, which lets an unauthenticated actor upload and execute code.

← Back to Vulnerabilities