Universal Copy Service, a popular software suite utilized by medical laboratories for DNA sequencing, has been found to have two high-severity vulnerabilities that could allow hackers to take over targeted endpoints and extract sensitive data. According to a joint security advisory from the US Cybersecurity Infrastructure Security Agency (CISA) and the FDA, an unauthenticated malicious actor could remotely upload and execute code at the operating system level, allowing them to modify settings, configurations, software, or access sensitive data on the affected product. Developed by California-based medical technology company Illumina, the software is used by research organizations, academic institutions, biotechnology firms, and pharmaceutical companies in 140 countries.
The two vulnerabilities, CVE-2023-1968 and CVE-2023-1966, are a 10/10 critical vulnerability that enables hackers to listen to all network traffic, potentially finding more vulnerable hosts on the network, and a 7.4/10 high-severity vulnerability that enables users to run commands with elevated privileges, respectively. Illumina has sent notifications to affected customers instructing them to check their instruments and medical devices for potential exploitation of the vulnerability. The vulnerabilities impact multiple Illumina products, and the mitigation measures vary depending on the software in question. Illumina recommends updating system software, configuring UCS account credentials, and closing specific firewall ports that may be abused.
The CISA and FDA have urged Universal Copy Service users to patch the software immediately. While Illumina has informed its customers of the vulnerability, it is essential that organizations apply the necessary updates to ensure the software’s security. The medical sector is frequently targeted by cybercriminals seeking to exploit vulnerabilities in medical software to steal valuable data or disrupt healthcare services. Thus, it is crucial that medical laboratories and hospitals stay vigilant and secure their systems against cyber threats.
