Skip to content
Fencer Vulns
high 7.4

CVE-2023-1966 json

CVE-2023-1966

published 2023-04-28 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24152

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.9%
EPSS 0.9% chance of exploitation in 30 days, percentile 60%
public exploits
0
none known

Summary

Instruments with Illumina Universal Copy Service v1.x and v2.x contain an unnecessary privileges vulnerability. An unauthenticated malicious actor could upload and execute code remotely at the operating system level, which could allow an attacker to change settings, configurations, software, or access sensitive data on the affected product.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-23-117-01 updated cvss 7.4

Illumina Universal Copy Service

  • Illumina iScan Control Software 4.0.0, 4.0.5 Illumina iSeq 100 Illumina MiniSeq Control Software >= 2.0 Illumina MiSeq Control Software 4.0 Illumina MiSeqDx Operating Software >= 4.0.1 Illumina NextSeq 500/550 Control Software 4.0
    +5 more products
    Illumina NextSeq 550Dx Control Software 4.0 Illumina NextSeq 550Dx Operating Software >= 1.0.0, <= 1.3.1, >= 1.3.3 Illumina NextSeq 1000/2000 Control Software <= 1.4.1 Illumina NovaSeq 6000 Control Software <= 1.7 Illumina NovaSeq Control Software 1.8
    affected: vendor fix support.illumina.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

0.92% chance of exploitation in the next 30 days, higher than 60% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Illumina iScan Control Software
  • Illumina MiniSeq Control Software
  • Illumina iSeq 100
  • Illumina MiSeq Control Software
  • Illumina MiSeqDx Operating Software
  • Illumina NextSeq 500/550 Control Software
  • Illumina NextSeq 550Dx Control Software
  • Illumina NextSeq 550Dx Operating Software
  • Illumina NextSeq 1000/2000 Control Software
  • Illumina NovaSeq 6000 Control Software
  • Illumina NovaSeq Control Software

Classification

Weakness
  • CWE-250 Execution with Unnecessary Privileges
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.