2026-08-05 · view entry permalink →
CVE-2026-17583, Thermo Fisher Applied Biosystems genetic analyzers write DNA result files with no integrity checking, so results can be altered after the run and no vendor fix is offered
CISA published ICS medical advisory ICSMA-26-216-01 on 2026-08-04, covering CVE-2026-17583 in Thermo Fisher Applied Biosystems genetic analyzers. The defect is a missing integrity check: the .fsa and .hid files these instruments produce can be edited after they are written, and CISA states that successful exploitation could allow an attacker to modify those output files, tampering with DNA data and resulting in inaccurate test results (CISA, 2026-08-04). The advisory carries a CVSS 3.1 base score of 8.4 with a local attack vector, requiring no privileges and no user interaction once the attacker is on the data-collection workstation. The affected list is long and spans generations of hardware, from the current SeqStudio and 3500 series back to the ABI PRISM 310, and CISA names no vendor patch; its recommendations are minimising exposure and defence in depth.
The reason this belongs in a European public-sector brief despite a local-only vector is who runs these instruments. These are the capillary-electrophoresis platforms used by forensic-science institutes serving police and judicial processes, and by clinical and public-health genomics laboratories. The impact class is unusual for this brief: not confidentiality, not availability, but integrity of a result that a court or a clinician will rely on. A tampered .fsa file does not announce itself as an incident; it produces a wrong answer that everything downstream treats as correct, and the instrument software offers no way to detect that the file changed after the run that produced it.
The attack precondition is access to the data-collection workstation or its file store, which places this firmly in the post-compromise and insider space rather than the remote-exploitation space. That is also why the usual triage instinct (low CVSS vector, no exploitation reported, wait for the patch) reaches the wrong answer here. There is no patch to wait for, and the control that closes the gap is architectural rather than a software update.
Detection concepts, telemetry class first. File-integrity monitoring on the .fsa and .hid output directories is the direct signal, and the specific event worth alerting on is a write or rename to a result file after the run that generated it has completed; a legitimate instrument run creates its outputs once. Correlate that with interactive logon events and removable-media events on the data-collection workstation, since the vector requires someone or something operating on that host.
Triage: laboratory information systems, backup agents and analysis software legitimately read these files constantly, and reanalysis workflows may write new derived files. The discriminator is modification in place of an existing result file versus creation of a new one, and whether the writing process is the instrument's own data-collection software during an active run.
Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulting in inaccurate test results.
Thermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified.
Applied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3
Applied Biosystems 3130 Series Data Collection Software: Product is End of Life (EoL), no update provided
The earlier entry's central claim was false, and the correction runs the wrong way round from the usual; a flaw previously described here as unfixable has a fix, and readers were told not to look for one.
CISA's advisory ICSMA-26-216-01 carries eight per-product vendor-fix records for this flaw, alongside seven mitigation records. Five of the eight name a patched version for a specific product line: "Applied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3", and correspondingly 3730/3730xL Data Collection Software to 5.0.3, SeqStudio Genetic Analyzer Data Collection Software to 1.2.6, SeqStudio Flex Series Instrument Software to 1.2.1, and GeneMapper ID-X Software to 1.7.4 (CISA ICSMA-26-216-01 (CSAF), 2026-08-04). Three products are genuinely unfixed, and the advisory says why rather than staying silent: the 3130 Series, ABI PRISM 3100/3100-Avant and ABI PRISM 310 Data Collection Software each carry "Product is End of Life (EoL), no update provided" (CISA ICSMA-26-216-01 (CSAF), 2026-08-04). The original entry generalised the end-of-life products' position to the whole product set.
The substance of the fix matters as much as its existence, because the earlier entry argued that no software update could address the problem and that only an architectural control (moving completed .fsa/.hid files into append-only or signed storage) would do. The advisory says the updates do precisely that job in the instrument software: "Thermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified" (CISA ICSMA-26-216-01 (CSAF), 2026-08-04). The interim measures the original entry treated as the whole answer (encrypted storage media, access restriction to authorised personnel, least privilege on the instrument hosts, and firewall rules and network ACLs limiting internet connectivity to trusted sources) are in the advisory as what to do until the applicable updates are installed, not instead of them.
Nothing about the flaw itself changes: the CVSS 3.1 base score of 8.4, the local attack vector, the affected version list and the mechanism (result files written with no integrity checking, so a file altered after the run reads as authentic) were all correct in the original entry and were re-verified in this audit. What changes is the disposition. For five of the eight product lines this is a patching task on a normal change window, and this entry's vulnerability record now carries the patched versions; the earlier no-patch status would otherwise leave anyone asking "is my version patched?" with a wrong no.
Triage: an instrument host still reporting a Data Collection Software version at or below the affected boundary after the update window is the discriminator between "unpatchable end-of-life product" and "patchable product nobody updated", the two look identical in an asset inventory that records only the product family, and only the version string separates them.