Applied Biosystems Analyzers CVE-2026-17583

Exploitation requires local file system access to the directory where .fsa or .hid output files are stored on the workstation connected to the affected genetic analyzer instrument. The CVSS 4.0 vector specifies PR:N, meaning no elevated operating system privileges are needed - any standard local user account with read-write permissions on the output directory can perform the modification. The vulnerability is present across the default output pipeline: no special configuration, feature flag, or non-default mode is required because the integrity check is absent by design across all affected product versions. Exploitation is limited to actors with physical or remote desktop access to the instrument-connected workstation; network-remote unauthenticated exploitation is not possible given AV:L. The ABI PRISM 310 and 3100 series are legacy platforms likely in end-of-life deployments, which may have weaker surrounding access controls and patch management, increasing insider-threat risk in those environments.

The CVSS 4.0 score of 8.3 (AV:L/AC:L/AT:N/PR:N/UI:N with VI:H/VA:H and SI:H) reflects low attack complexity and no authentication requirement once file system access exists, but the local attack vector (AV:L) substantially limits the exposed attack surface compared to network-exploitable vulnerabilities. EPSS data was not provided; given the specialized deployment context and absence of KEV listing, opportunistic exploitation at scale is unlikely. The real-world risk is domain-specific but severe: in forensic laboratories using GeneMapper ID-X, a tampered .hid file could alter a DNA profile used as criminal evidence; in clinical Sanger sequencing environments, a modified .fsa file could change a variant call. The VA:H metric in the provided vector may reflect scenarios where corrupted files render the analysis pipeline unable to process results, effectively making the instrument's output unusable. No conflicting signals exist between the CVSS vector and description. The absence of KEV listing and public POC reduces urgency for most deployments, but the potential for high-consequence, low-detectability fraud in forensic or clinical contexts elevates mission-critical risk independent of EPSS probability.

A lab technician or insider adversary with standard user access to the workstation connected to a forensic DNA analyzer opens a .hid output file in a hex editor or .fsa-compatible viewer and alters allele peak calls to match a desired DNA profile. Because the GeneMapper ID-X software performs no signature or checksum validation on import, it processes the modified file identically to authentic instrument output, and the falsified STR profile is reported as a match or exclusion in a case report. No exploit code is required - the attack is a manual file edit requiring only knowledge of the file format.