CVE-2023-1966: Illumina Iscan Firmware RCE Vulnerability

CVE-2023-1966 Overview

CVE-2023-1966 is a critical unnecessary privileges vulnerability affecting Illumina Universal Copy Service versions 1.x and 2.x deployed across multiple Illumina DNA sequencing instruments. This vulnerability allows an unauthenticated malicious actor to upload and execute code remotely at the operating system level, potentially enabling attackers to change settings, configurations, software, or access sensitive data on the affected medical devices.

Critical Impact

Unauthenticated remote code execution on medical DNA sequencing instruments could compromise patient data integrity, disrupt clinical laboratory operations, and potentially affect diagnostic results in healthcare environments.

Affected Products

• Illumina iScan (Firmware versions 4.0.0 and 4.0.5)
• Illumina iSeq 100
• Illumina MiniSeq
• Illumina MiSeq
• Illumina MiSeqDx (including RUO mode)
• Illumina NextSeq 500 (Firmware 4.0)
• Illumina NextSeq 550 (Firmware 4.0)
• Illumina NextSeq 550Dx (including RUO mode)
• Illumina NextSeq 1000 (Firmware 1.4.1)
• Illumina NextSeq 2000 (Firmware 1.4.1)
• Illumina NovaSeq 6000 (including Firmware 1.8)

Discovery Timeline

• April 28, 2023 - CVE-2023-1966 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-1966

Vulnerability Analysis

This vulnerability stems from CWE-250 (Execution with Unnecessary Privileges) and CWE-269 (Improper Privilege Management) in the Illumina Universal Copy Service. The service operates with elevated privileges that are not required for its core functionality, creating an attack surface that allows unauthenticated attackers to execute arbitrary code with system-level permissions.

The Illumina Universal Copy Service is a software component used across Illumina's genomic sequencing instrument portfolio to manage data transfer and file operations. The excessive privilege model combined with insufficient authentication controls means that network-accessible attackers can leverage the service to gain complete control over the affected instruments without requiring any credentials.

Root Cause

The root cause is an improper privilege management implementation in the Illumina Universal Copy Service. The service runs with unnecessary elevated privileges at the operating system level, and lacks proper authentication mechanisms to validate requests before executing operations. This architectural flaw allows any network-reachable actor to submit requests that the service will process with its elevated privilege context.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker with network access to the affected instrument can:

1. Connect to the Illumina Universal Copy Service remotely
2. Submit malicious payloads designed to execute arbitrary code
3. Achieve code execution at the operating system level due to the service's elevated privileges
4. Modify system settings, configurations, access sensitive genomic data, or install persistent malware

The vulnerability is particularly concerning in healthcare environments where these instruments may process sensitive patient genetic information and contribute to clinical diagnostic workflows.

Detection Methods for CVE-2023-1966

Indicators of Compromise

• Unexpected network connections to Illumina sequencing instruments from unauthorized IP addresses
• Unusual file operations or new executables appearing on instrument systems
• Modifications to system configurations or service settings outside of scheduled maintenance windows
• Anomalous process execution activity associated with the Universal Copy Service
• Unexpected outbound network traffic from sequencing instruments

Detection Strategies

• Implement network intrusion detection systems (NIDS) to monitor traffic patterns to and from Illumina instruments
• Deploy endpoint detection and response (EDR) solutions on instrument workstations where supported
• Monitor Windows Event Logs for suspicious service activity, process creation, and file system changes
• Establish baseline network behavior for Illumina devices and alert on deviations

Monitoring Recommendations

• Configure SIEM alerts for any unauthenticated access attempts to Illumina instrument services
• Monitor for unauthorized firmware or software modifications on affected devices
• Implement file integrity monitoring on critical system directories
• Track all administrative access and configuration changes to sequencing instruments

How to Mitigate CVE-2023-1966

Immediate Actions Required

• Isolate affected Illumina instruments on segmented networks with strict access controls
• Restrict network access to the Universal Copy Service to only authorized systems and users
• Review and audit all recent access logs for potentially malicious activity
• Contact Illumina support for guidance on applying patches to specific instrument models
• Implement firewall rules to block unauthorized network access to affected devices

Patch Information

Illumina has released updated versions of the Universal Copy Service to address this vulnerability. Affected organizations should download the latest firmware and software updates from the Illumina Universal Copy Service Download Page. Additional guidance is available in the CISA Medical Advisory ICSMA-23-117-01.

Healthcare organizations should coordinate with Illumina and follow established medical device update procedures to ensure continued compliance with regulatory requirements while applying security patches.

Workarounds

• Implement network segmentation to isolate Illumina instruments from general network traffic
• Deploy host-based firewalls to restrict incoming connections to the Universal Copy Service
• Disable remote access to instruments when not operationally required
• Implement VPN or jump host requirements for any necessary remote access to instrument networks

# Network isolation configuration example (firewall rules)
# Restrict access to Illumina instrument subnet
iptables -A INPUT -s <authorized_subnet> -d <illumina_instrument_ip> -j ACCEPT
iptables -A INPUT -d <illumina_instrument_ip> -j DROP