CVE-2022-1524 - Vulnerability Details - OpenCVE

LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Illumina	Iseq 100 Local Run Manager Miniseq Miseq Miseq Dx Nextseq 500 Nextseq 550 Nextseq 550dx

Configuration 1 [-]

AND

cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:illumina:iseq_100:-:::::::*
	cpe:2.3:h:illumina:miniseq:-:::::::*
	cpe:2.3:h:illumina:miseq:-:::::::*
	cpe:2.3:h:illumina:miseq_dx:-:::::::*
	cpe:2.3:h:illumina:nextseq_500:-:::::::*
	cpe:2.3:h:illumina:nextseq_550:-:::::::*
	cpe:2.3:h:illumina:nextseq_550dx:-:::::::*

No data.

References

Link	Providers
https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02

History

Wed, 16 Apr 2025 18:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: icscert

Published: 2022-06-24T15:00:16.330Z

Updated: 2025-04-16T17:52:17.725Z

Reserved: 2022-04-28T00:00:00.000Z

Link: CVE-2022-1524

Vulnrichment

Updated: 2024-08-03T00:10:03.321Z

NVD

Status : Modified

Published: 2022-06-24T15:15:09.437

Modified: 2024-11-21T06:40:54.017

Link: CVE-2022-1524

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "NextSeq 550Dx", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiSeq Dx", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "NextSeq 500 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "NextSeq 550 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiSeq Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "iSeq 100 Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"product": "MiniSeq Instrument", "vendor": "Illumina", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}], "datePublic": "2022-06-02T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-06-24T15:00:16.000Z", "orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}], "source": {"discovery": "UNKNOWN"}, "title": "3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319", "x_legacyV4Record": {"CVE_data_meta": {"AKA": "", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220602T06:00:00.000000Z", "ID": "CVE-2022-1524", "STATE": "PUBLIC", "TITLE": "3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "NextSeq 550Dx", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiSeq Dx", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "NextSeq 500 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "NextSeq 550 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiSeq Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "iSeq 100 Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"product_name": "MiniSeq Instrument", "version": {"version_data": [{"platform": "", "version_affected": "=", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1"}]}}]}, "vendor_name": "Illumina"}]}}, "credit": [], "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."}]}, "impact": {"cvss": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-319 Cleartext Transmission of Sensitive Information"}]}]}, "references": {"reference_data": [{"name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "refsource": "MISC", "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}]}, "solution": [], "source": {"advisory": "", "defect": [], "discovery": "UNKNOWN"}, "work_around": []}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:03.321Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-16T17:28:35.654447Z", "id": "CVE-2022-1524", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T17:52:17.725Z"}}]}, "cveMetadata": {"assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "assignerShortName": "icscert", "cveId": "CVE-2022-1524", "datePublished": "2022-06-24T15:00:16.330Z", "dateReserved": "2022-04-28T00:00:00.000Z", "dateUpdated": "2025-04-16T17:52:17.725Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T00:10:03.321Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-1524", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-04-16T17:28:35.654447Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-16T17:28:37.108Z"}}], "cna": {"title": "3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319", "source": {"discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "Illumina", "product": "NextSeq 550Dx", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "MiSeq Dx", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "NextSeq 500 Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "NextSeq 550 Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "MiSeq Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "iSeq 100 Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}, {"vendor": "Illumina", "product": "MiniSeq Instrument", "versions": [{"status": "affected", "version": "LRM Versions 1.3 to 3.1"}]}], "datePublic": "2022-06-02T00:00:00.000Z", "references": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-319", "description": "CWE-319 Cleartext Transmission of Sensitive Information"}]}], "providerMetadata": {"orgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "shortName": "icscert", "dateUpdated": "2022-06-24T15:00:16.000Z"}, "x_legacyV4Record": {"credit": [], "impact": {"cvss": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, "source": {"defect": [], "advisory": "", "discovery": "UNKNOWN"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "NextSeq 550Dx"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "MiSeq Dx"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "NextSeq 500 Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "NextSeq 550 Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "MiSeq Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "iSeq 100 Instrument"}]}, "vendor_name": "Illumina"}, {"product": {"product_data": [{"version": {"version_data": [{"platform": "", "version_name": "", "version_value": "LRM Versions 1.3 to 3.1", "version_affected": "="}]}, "product_name": "MiniSeq Instrument"}]}, "vendor_name": "Illumina"}]}}, "solution": [], "data_type": "CVE", "references": {"reference_data": [{"url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "name": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-319 Cleartext Transmission of Sensitive Information"}]}]}, "work_around": [], "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2022-1524", "AKA": "", "STATE": "PUBLIC", "TITLE": "3.2.5 CLEARTEXT TRANSMISSION OF SENSITIVE INFORMATION CWE-319", "ASSIGNER": "ics-cert@hq.dhs.gov", "DATE_PUBLIC": "20220602T06:00:00.000000Z"}}}}, "cveMetadata": {"cveId": "CVE-2022-1524", "state": "PUBLISHED", "dateUpdated": "2025-04-16T17:52:17.725Z", "dateReserved": "2022-04-28T00:00:00.000Z", "assignerOrgId": "7d14cffa-0d7d-4270-9dc0-52cabd5a23a6", "datePublished": "2022-06-24T15:00:16.330Z", "assignerShortName": "icscert"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:illumina:local_run_manager:*:*:*:*:*:*:*:*", "matchCriteriaId": "C6A76287-2C7D-4EDD-B551-3E162819A08B", "versionEndIncluding": "3.1", "versionStartIncluding": "1.3", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:illumina:iseq_100:-:*:*:*:*:*:*:*", "matchCriteriaId": "0136ED72-BF05-404D-910A-DA5B73F69771", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miniseq:-:*:*:*:*:*:*:*", "matchCriteriaId": "2DA69772-E795-4A64-A6A1-0BDD503D263B", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miseq:-:*:*:*:*:*:*:*", "matchCriteriaId": "8AFB0D5A-AF5A-4A84-963F-C6307ADCFF4E", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:miseq_dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "D7731600-AE91-4D74-A219-BAE147B29A7F", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_500:-:*:*:*:*:*:*:*", "matchCriteriaId": "1C7AEA5A-707D-4BF4-9DF6-BDE6E6D97B60", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_550:-:*:*:*:*:*:*:*", "matchCriteriaId": "BF742B4D-0FC5-443A-8040-7B0A1B298707", "vulnerable": false}, {"criteria": "cpe:2.3:h:illumina:nextseq_550dx:-:*:*:*:*:*:*:*", "matchCriteriaId": "B3D5AB9D-7EAA-45F2-A10F-A2D142B20D3D", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "descriptions": [{"lang": "en", "value": "LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credentials."}, {"lang": "es", "value": "LRM versiones 2.4 y anteriores, no implementa el cifrado TLS. Un actor malicioso puede realizar un ataque de tipo MITM a los datos confidenciales en tr\u00e1nsito, incluidas las credenciales"}], "id": "CVE-2022-1524", "lastModified": "2024-11-21T06:40:54.017", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.2, "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-06-24T15:15:09.437", "references": [{"source": "ics-cert@hq.dhs.gov", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "US Government Resource"], "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02"}], "sourceIdentifier": "ics-cert@hq.dhs.gov", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-319"}], "source": "ics-cert@hq.dhs.gov", "type": "Secondary"}]}