« Volver al listado

CVE-2022-1519

Estado: ModificadaCrítica (9.8)—

LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Illumina — Local RUN Manager

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2022-1519",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2022-1519",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-16T15:54:29.024230Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 10,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "LOW",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 10,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Illumina",
          "product": "NextSeq 550Dx",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        },
        {
          "vendor": "Illumina",
          "product": "MiSeq Dx",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        },
        {
          "vendor": "Illumina",
          "product": "NextSeq 500 Instrument",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        },
        {
          "vendor": "Illumina",
          "product": "NextSeq 550 Instrument",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        },
        {
          "vendor": "Illumina",
          "product": "MiSeq Instrument",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        },
        {
          "vendor": "Illumina",
          "product": "iSeq 100 Instrument",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        },
        {
          "vendor": "Illumina",
          "product": "MiniSeq Instrument",
          "versions": [
            {
              "status": "affected",
              "version": "LRM Versions 1.3 to 3.1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2022-06-24T15:15:09.333",
  "references": [
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-434"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "LRM does not restrict the types of files that can be uploaded to the affected product. A malicious actor can upload any file type, including executable code that allows for a remote code exploit."
    },
    {
      "lang": "es",
      "value": "LRM no restringe los tipos de archivos que pueden cargarse en el producto afectado. Un actor malicioso puede cargar cualquier tipo de archivo, incluyendo código ejecutable que permite una explotación de código remoto"
    }
  ],
  "lastModified": "2026-06-17T04:22:36.070",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B",
              "versionEndIncluding": "3.1",
              "versionStartIncluding": "1.3"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771"
            },
            {
              "criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B"
            },
            {
              "criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E"
            },
            {
              "criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F"
            },
            {
              "criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60"
            },
            {
              "criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707"
            },
            {
              "criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}