Skip to content
Fencer Vulns
critical 10.0

CVE-2023-1968 json

CVE-2023-1968

published 2023-04-28 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-24154

cvss
10.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.8%
EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits
0
none known

Summary

Instruments with Illumina Universal Copy Service v2.x are vulnerable due to binding to an unrestricted IP address. An unauthenticated malicious actor could use UCS to listen on all IP addresses, including those capable of accepting remote communications.

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSMA-23-117-01 updated cvss 10.0

Illumina Universal Copy Service

  • Illumina iScan Control Software 4.0.0, 4.0.5 Illumina iSeq 100 Illumina MiniSeq Control Software >= 2.0 Illumina MiSeq Control Software 4.0 Illumina MiSeqDx Operating Software >= 4.0.1 Illumina NextSeq 500/550 Control Software 4.0
    +5 more products
    Illumina NextSeq 550Dx Control Software 4.0 Illumina NextSeq 550Dx Operating Software >= 1.0.0, <= 1.3.1, >= 1.3.3 Illumina NextSeq 1000/2000 Control Software <= 1.4.1 Illumina NovaSeq 6000 Control Software <= 1.7 Illumina NovaSeq Control Software 1.8
    affected: vendor fix support.illumina.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

1.81% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 10.0 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

  • Illumina iScan Control Software
  • Illumina MiniSeq Control Software
  • Illumina iSeq 100
  • Illumina MiSeq Control Software
  • Illumina MiSeqDx Operating Software
  • Illumina NextSeq 500/550 Control Software
  • Illumina NextSeq 550Dx Control Software
  • Illumina NextSeq 550Dx Operating Software
  • Illumina NextSeq 1000/2000 Control Software
  • Illumina NovaSeq 6000 Control Software
  • Illumina NovaSeq Control Software

Classification

Weakness
  • CWE-1327 Binding to an Unrestricted IP Address

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.