CVE-2023-1968

Published: Apr 28, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.

Affected (16)

Products: Illumina: Iscan Firmware, Iseq 100 Firmware, Miniseq Firmware, Miseq Firmware, Miseqdx Firmware, Nextseq 500 Firmware, Nextseq 550 Firmware, Nextseq 550dx Firmware, Nextseq 1000 Firmware, Nextseq 2000 Firmware, Novaseq 6000 Firmware

11 products

Nextseq 550dx Firmware

Nextseq 1000 Firmware

Nextseq 2000 Firmware

Novaseq 6000 Firmware

Configuration A

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Iscan Firmware	Version 4.0.0
Illumina Iscan Firmware	Version 4.0.5

Running on/with	Platform Versions
Illumina Iscan	All versions

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Iseq 100 Firmware	All versions

Running on/with	Platform Versions
Illumina Iseq 100	All versions

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Miniseq Firmware	From 2.0

Running on/with	Platform Versions
Illumina Miniseq	All versions

Configuration D

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Miseq Firmware	From 4.0

Running on/with	Platform Versions
Illumina Miseq	All versions

Configuration E

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Miseqdx Firmware	From 4.0.1
Illumina Miseqdx Firmware	Version 4.0

Running on/with	Platform Versions
Illumina Miseqdx	All versions

Configuration F

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Nextseq 500 Firmware	Version 4.0

Running on/with	Platform Versions
Illumina Nextseq 500	All versions

Configuration G

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Nextseq 550 Firmware	Version 4.0

Running on/with	Platform Versions
Illumina Nextseq 550	All versions

Configuration H

3 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Nextseq 550dx Firmware	From 1.0.0 to 1.3.1
Illumina Nextseq 550dx Firmware	From 1.3.3
Illumina Nextseq 550dx Firmware	Version 4.0

Running on/with	Platform Versions
Illumina Nextseq 550dx	All versions

Configuration I

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Nextseq 1000 Firmware	Version 1.4.1

Running on/with	Platform Versions
Illumina Nextseq 1000	All versions

Configuration J

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Nextseq 2000 Firmware	Version 1.4.1

Running on/with	Platform Versions
Illumina Nextseq 2000	All versions

Configuration K

2 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Illumina Novaseq 6000 Firmware	Up to 1.7
Illumina Novaseq 6000 Firmware	Version 1.8

Running on/with	Platform Versions
Illumina Novaseq 6000	All versions

Related CWEs

CWE-1327

Binding to an Unrestricted IP Address

The product assigns the address 0.0.0.0 for a database server, a cloud service/instance, or any computing resource that communicates remotely.

References (4)

https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html

Source: ics-cert@hq.dhs.gov

Vendor Advisory

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01

Source: ics-cert@hq.dhs.gov

Third Party AdvisoryUS Government Resource

https://support.illumina.com/downloads/illumina-universal-copy-service-1-0.html

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://www.cisa.gov/news-events/ics-medical-advisories/icsma-23-117-01

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

Timeline

No history available yet.