DNA analyzer output could be tampered with, and the software would not notice

MedDevice Cyber Staff · Aug 4 · 3 min read · Via CISA

Researchers merged two DNA profiles into one output file and the analysis software raised no warning. That is the proof of concept behind ICSMA-26-216-01, and it should stop you.

Integrity checking lets software tell whether a file still holds exactly what was written to it, usually through a signature that any later change invalidates. Without it a stored result is trusted on sight; nothing asks whether the bytes on disk are the ones the instrument produced. The check gets skipped when designers assume the output lives inside a closed, trusted workflow.

Thermo Fisher Applied Biosystems genetic analyzers, the 3500, 3730, SeqStudio and GeneMapper ID-X lines, ship data-collection software with CVE-2026-17583: missing integrity checking on the .fsa and .hid output files, base score 8.4. An attacker with lab-server access could alter results in a way that is nearly undetectable. These instruments produce forensic and clinical evidence, and an output file you cannot trust is worse than one you cannot read, because someone will act on it. Nathan Adams of Forensic Bioinformatics and colleagues reported it.

A silent alteration matters more than a leak because these files are not merely read, they are believed and acted upon. A profile quietly merged or edited that still opens cleanly can steer an identification, a diagnosis or a courtroom conclusion. A confidentiality failure exposes information; an integrity failure corrupts the record downstream users treat as ground truth.

The response also shows the ceiling on a vendor fix. A corrected build protects instruments still under support, but products past their service life keep producing files with the same blind spot. That a live demonstration was needed to force the issue says much about integrity, the most overlooked of the core security properties.

Thermo Fisher shipped fixed software, though three end-of-life products stay unpatched. Sign the file, verify the signature, refuse the tampered one. Integrity checking is not optional on an instrument whose results end up in a courtroom.

Remediation Desk

For ProvidersOperators, hospitals, and clinical engineering

The data-collection software for Applied Biosystems analyzers did not verify the integrity of its own output, so a tampered file passed as genuine. Update per ICSMA-26-216-01 and add integrity verification to any workflow where analyzer output feeds a clinical or forensic decision.

Apply the vendor update. Move to the fixed software version named in ICSMA-26-216-01 across every analyzer workstation.
Sign or hash output files. Where results carry clinical or legal weight, attach a cryptographic signature or hash at creation and verify it before anyone acts on the data.
Restrict write access to result stores. Limit who and what can modify output files, and log every change so a silent merge like the proof of concept cannot happen unseen.

For Device ManufacturersAm I affected, and how to fix the class

Am I affected?

This class applies to devices with the properties below. Check them against your product to gauge exposure.

Required

app_file_upload app_database data_phi

Contributing

net_wired use_hospital_net sys_ots_software app_user_accounts

EMB3D

PID-28 PID-34

Fix the class in your product

The software does not verify the integrity of its own output, so a tampered result passes as genuine. As the maker, sign results at creation with a device-held key and verify the signature before anything consumes them, and lock down who can write the result store.

Sign on write. Compute a signature over the result at creation; hold the key in a secure element.
Verify on read. Refuse a result that fails its integrity check before it feeds a decision.
Audit every change. Restrict write access to the store and log modifications so a silent change is impossible.

Mapped EMB3D mitigations

Questions & Answers

What does CVE-2026-17583 affect?

Data-collection software for Applied Biosystems genetic analyzers. It did not verify the integrity of its own output files, so results could be altered without the software noticing.

Why is a missing integrity check a safety issue and not just a data issue?

These analyzers produce results that clinicians and labs rely on. If output can be changed silently, a wrong result can flow downstream into a decision, which is why CISA treated it as high severity in ICSMA-26-216-01.

What should labs do?

Apply the vendor update that adds integrity checking, and in the meantime protect the systems that store and move the output files so they cannot be tampered with.

← Back to Vulnerabilities