CVE-2022-1517 (GCVE-0-2022-1517)
Vulnerability from cvelistv5 – Published: 2022-06-24 15:00 – Updated: 2025-04-16 16:17
VLAI?
Summary
LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
Severity ?
10 (Critical)
CWE
- CWE-250 - cwe-250
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Illumina | NextSeq 550Dx |
Affected:
LRM Versions 1.3 to 3.1
|
||||||||||||||||||||||||||||||||
|
||||||||||||||||||||||||||||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:10:02.759Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-1517",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-16T15:54:32.128012Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-16T16:17:11.157Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "NextSeq 550Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Dx",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 500 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "NextSeq 550 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "iSeq 100 Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
},
{
"product": "MiniSeq Instrument",
"vendor": "Illumina",
"versions": [
{
"status": "affected",
"version": "LRM Versions 1.3 to 3.1"
}
]
}
],
"datePublic": "2022-06-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-250",
"description": "cwe-250",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-06-24T15:00:12.000Z",
"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"shortName": "icscert"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
],
"source": {
"discovery": "UNKNOWN"
},
"title": "3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250",
"x_legacyV4Record": {
"CVE_data_meta": {
"AKA": "",
"ASSIGNER": "ics-cert@hq.dhs.gov",
"DATE_PUBLIC": "20220602T06:00:00.000000Z",
"ID": "CVE-2022-1517",
"STATE": "PUBLIC",
"TITLE": "3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Dx",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 500 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "NextSeq 550 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "iSeq 100 Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
},
{
"product": {
"product_data": [
{
"product_name": "MiniSeq Instrument",
"version": {
"version_data": [
{
"platform": "",
"version_affected": "=",
"version_name": "",
"version_value": "LRM Versions 1.3 to 3.1"
}
]
}
}
]
},
"vendor_name": "Illumina"
}
]
}
},
"credit": [],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 10,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "cwe-250"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
"refsource": "MISC",
"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"
}
]
},
"solution": [],
"source": {
"advisory": "",
"defect": [],
"discovery": "UNKNOWN"
},
"work_around": []
}
}
},
"cveMetadata": {
"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6",
"assignerShortName": "icscert",
"cveId": "CVE-2022-1517",
"datePublished": "2022-06-24T15:00:12.934Z",
"dateReserved": "2022-04-28T00:00:00.000Z",
"dateUpdated": "2025-04-16T16:17:11.157Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.3\", \"versionEndIncluding\": \"3.1\", \"matchCriteriaId\": \"C6A76287-2C7D-4EDD-B551-3E162819A08B\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0136ED72-BF05-404D-910A-DA5B73F69771\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2DA69772-E795-4A64-A6A1-0BDD503D263B\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D7731600-AE91-4D74-A219-BAE147B29A7F\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BF742B4D-0FC5-443A-8040-7B0A1B298707\"}, {\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.\"}, {\"lang\": \"es\", \"value\": \"LRM usa altos privilegios. Un actor malicioso no autenticado puede cargar y ejecutar c\\u00f3digo de forma remota a nivel del sistema operativo, lo que puede permitir a un atacante cambiar los ajustes, configuraciones, software o acceder a datos confidenciales en el producto afectado. Un atacante tambi\\u00e9n podr\\u00eda explotar esta vulnerabilidad para acceder a APIs no destinadas al uso general e interactuar mediante la red\"}]",
"id": "CVE-2022-1517",
"lastModified": "2024-11-21T06:40:53.083",
"metrics": "{\"cvssMetricV31\": [{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"baseScore\": 10.0, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 6.0}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\", \"baseScore\": 9.8, \"baseSeverity\": \"CRITICAL\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 5.9}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:C/I:C/A:C\", \"baseScore\": 10.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"COMPLETE\", \"integrityImpact\": \"COMPLETE\", \"availabilityImpact\": \"COMPLETE\"}, \"baseSeverity\": \"HIGH\", \"exploitabilityScore\": 10.0, \"impactScore\": 10.0, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
"published": "2022-06-24T15:15:09.220",
"references": "[{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"source\": \"ics-cert@hq.dhs.gov\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}, {\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\", \"US Government Resource\"]}]",
"sourceIdentifier": "ics-cert@hq.dhs.gov",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"ics-cert@hq.dhs.gov\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-250\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-269\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2022-1517\",\"sourceIdentifier\":\"ics-cert@hq.dhs.gov\",\"published\":\"2022-06-24T15:15:09.220\",\"lastModified\":\"2024-11-21T06:40:53.083\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.\"},{\"lang\":\"es\",\"value\":\"LRM usa altos privilegios. Un actor malicioso no autenticado puede cargar y ejecutar c\u00f3digo de forma remota a nivel del sistema operativo, lo que puede permitir a un atacante cambiar los ajustes, configuraciones, software o acceder a datos confidenciales en el producto afectado. Un atacante tambi\u00e9n podr\u00eda explotar esta vulnerabilidad para acceder a APIs no destinadas al uso general e interactuar mediante la red\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\",\"baseScore\":10.0,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":6.0},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:C/I:C/A:C\",\"baseScore\":10.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"COMPLETE\",\"integrityImpact\":\"COMPLETE\",\"availabilityImpact\":\"COMPLETE\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":10.0,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"ics-cert@hq.dhs.gov\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-250\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-269\"}]}],\"configurations\":[{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.3\",\"versionEndIncluding\":\"3.1\",\"matchCriteriaId\":\"C6A76287-2C7D-4EDD-B551-3E162819A08B\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0136ED72-BF05-404D-910A-DA5B73F69771\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DA69772-E795-4A64-A6A1-0BDD503D263B\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7731600-AE91-4D74-A219-BAE147B29A7F\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BF742B4D-0FC5-443A-8040-7B0A1B298707\"},{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D\"}]}]}],\"references\":[{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\",\"source\":\"ics-cert@hq.dhs.gov\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"tags\": [\"x_refsource_MISC\", \"x_transferred\"]}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2024-08-03T00:10:02.759Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-1517\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-04-16T15:54:32.128012Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-04-16T15:54:34.425Z\"}}], \"cna\": {\"title\": \"3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}], \"affected\": [{\"vendor\": \"Illumina\", \"product\": \"NextSeq 550Dx\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"MiSeq Dx\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"NextSeq 500 Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"NextSeq 550 Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"MiSeq Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"iSeq 100 Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}, {\"vendor\": \"Illumina\", \"product\": \"MiniSeq Instrument\", \"versions\": [{\"status\": \"affected\", \"version\": \"LRM Versions 1.3 to 3.1\"}]}], \"datePublic\": \"2022-06-02T00:00:00.000Z\", \"references\": [{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"tags\": [\"x_refsource_MISC\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-250\", \"description\": \"cwe-250\"}]}], \"providerMetadata\": {\"orgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"shortName\": \"icscert\", \"dateUpdated\": \"2022-06-24T15:00:12.000Z\"}, \"x_legacyV4Record\": {\"credit\": [], \"impact\": {\"cvss\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 10, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"CRITICAL\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, \"source\": {\"defect\": [], \"advisory\": \"\", \"discovery\": \"UNKNOWN\"}, \"affects\": {\"vendor\": {\"vendor_data\": [{\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"NextSeq 550Dx\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"MiSeq Dx\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"NextSeq 500 Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"NextSeq 550 Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"MiSeq Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"iSeq 100 Instrument\"}]}, \"vendor_name\": \"Illumina\"}, {\"product\": {\"product_data\": [{\"version\": {\"version_data\": [{\"platform\": \"\", \"version_name\": \"\", \"version_value\": \"LRM Versions 1.3 to 3.1\", \"version_affected\": \"=\"}]}, \"product_name\": \"MiniSeq Instrument\"}]}, \"vendor_name\": \"Illumina\"}]}}, \"solution\": [], \"data_type\": \"CVE\", \"references\": {\"reference_data\": [{\"url\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"name\": \"https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02\", \"refsource\": \"MISC\"}]}, \"data_format\": \"MITRE\", \"description\": {\"description_data\": [{\"lang\": \"eng\", \"value\": \"LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.\"}]}, \"problemtype\": {\"problemtype_data\": [{\"description\": [{\"lang\": \"eng\", \"value\": \"cwe-250\"}]}]}, \"work_around\": [], \"data_version\": \"4.0\", \"CVE_data_meta\": {\"ID\": \"CVE-2022-1517\", \"AKA\": \"\", \"STATE\": \"PUBLIC\", \"TITLE\": \"3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250\", \"ASSIGNER\": \"ics-cert@hq.dhs.gov\", \"DATE_PUBLIC\": \"20220602T06:00:00.000000Z\"}}}}",
"cveMetadata": "{\"cveId\": \"CVE-2022-1517\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-04-16T16:17:11.157Z\", \"dateReserved\": \"2022-04-28T00:00:00.000Z\", \"assignerOrgId\": \"7d14cffa-0d7d-4270-9dc0-52cabd5a23a6\", \"datePublished\": \"2022-06-24T15:00:12.934Z\", \"assignerShortName\": \"icscert\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…