« Volver al listado

CVE-2026-17583

Estado: AnalizadaAlta (8.3)—

The affected

Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Acceso local sin interacción (AV:L, PR:N, UI:N) con integridad alta (VI:H) permite escalada o manipulación de archivos .fsa/.hid. CWE-353 (temporal race condition) facilita edición maliciosa de datos de ADN, alterando resultados de pruebas genéticas.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

User TrainingUser Account ManagementThreat Intelligence ProgramRestrict File and Directory PermissionsRemote Data StorageExecution Prevention

Tecnologías afectadas (8)

Thermofisher — ABI Prism 3100/3100-avant Data Collection SoftwareThermofisher — ABI Prism 310 Data Collection SoftwareThermofisher — Applied Biosystems 3130 Series Data Collection SoftwareThermofisher — Applied Biosystems 3500/3500xl Series Data Collection SoftwareThermofisher — Applied Biosystems 3730/3730xl Series Data Collection SoftwareThermofisher — Applied Biosystems Seqstudio Flex Series Instrument SoftwareThermofisher — Applied Biosystems Seqstudio Genetic Analyzer Data Collection SoftwareThermofisher — Genemapper Id-x

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-17583",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-17583",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-06T13:34:47.788856Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.4,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.5
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "ics-cert@hq.dhs.gov",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 8.3,
          "Automatable": "NOT_DEFINED",
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "HIGH",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "ics-cert@hq.dhs.gov",
      "affectedData": [
        {
          "vendor": "Thermo Fisher",
          "product": "Applied Biosystems 3500/3500xL Series Data Collection Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "4.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "Applied Biosystems 3730/3730xL Series Data Collection Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "5.0.2"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.2.5"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "Applied Biosystems SeqStudio Flex Series Instrument Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.2.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "Applied Biosystems GeneMapper ID-X Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "1.7.3"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "Applied Biosystems 3130 Series Data Collection Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "4.1"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "ABI PRISM 3100/3100-Avant Data Collection Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "2.0"
            }
          ],
          "defaultStatus": "unaffected"
        },
        {
          "vendor": "Thermo Fisher",
          "product": "ABI PRISM 310 Data Collection Software",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "versionType": "custom",
              "lessThanOrEqual": "3.1"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2026-08-05T21:16:57.393",
  "references": [
    {
      "url": "https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-216-01",
      "tags": [
        "Patch",
        "Third Party Advisory",
        "US Government Resource"
      ],
      "source": "ics-cert@hq.dhs.gov"
    },
    {
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-17583",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "ics-cert@hq.dhs.gov"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "ics-cert@hq.dhs.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-353"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The affected\n\nThermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes."
    }
  ],
  "lastModified": "2026-08-26T14:50:43.400",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:thermofisher:abi_prism_310_data_collection_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "052676E2-92C8-480C-B163-D3C4AEBA6ECF",
              "versionEndIncluding": "3.1"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:abi_prism_3100\\/3100-avant_data_collection_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24B89BAB-EFA0-48D1-9E12-621A3AD95438",
              "versionEndIncluding": "2.0"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:applied_biosystems_3130_series_data_collection_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2DA06A19-0C69-43AC-91C4-CBCCEB3E1525",
              "versionEndIncluding": "4.1"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:applied_biosystems_3500\\/3500xl_series_data_collection_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A594FA04-80D2-44F5-B0E3-BB8A9600D68A",
              "versionEndExcluding": "4.0.3"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:applied_biosystems_3730\\/3730xl_series_data_collection_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "946E2337-8B1B-49F4-9597-A38C1CCC7A30",
              "versionEndExcluding": "5.0.3"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:applied_biosystems_seqstudio_flex_series_instrument_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A4A8182F-41FD-4271-9120-844764414F85",
              "versionEndExcluding": "1.2.1"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:applied_biosystems_seqstudio_genetic_analyzer_data_collection_software:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2C85423A-B2C6-4D68-8B0A-394B5E8DB3AA",
              "versionEndExcluding": "1.2.6"
            },
            {
              "criteria": "cpe:2.3:a:thermofisher:genemapper_id-x:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E32BD188-9C4D-428D-8C64-154709AFE4AA",
              "versionEndExcluding": "1.7.4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "ics-cert@hq.dhs.gov"
}