EUVD-2026-53616
GHSA-5p87-q7f6-jf7x
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local file edit requires no privileges (PR:N); scope changes (S:C) because falsified DNA data impacts downstream forensic/clinical decisions beyond the instrumented system; no confidentiality or availability impact from mere file modification.
Primary rating from Vendor (icscert).
CVSS VectorVendor: icscert
CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3DescriptionCVE.org
The affected
Thermo Fisher Applied Biosystems Genetic Analyzers are vulnerable because .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes.
AnalysisAI
Integrity tampering in Thermo Fisher Applied Biosystems Genetic Analyzers allows any user with local file system access to silently modify .fsa and .hid output files - the raw DNA sequence and fragment analysis data produced by these instruments - because no cryptographic integrity check (CWE-353) is applied to these files. Affected products span eight distinct data collection and analysis software lines, including the forensic-grade GeneMapper ID-X platform, meaning tampered files could propagate falsified DNA profiles into criminal proceedings or clinical diagnostics without detection. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local file system access to the directory where .fsa or .hid output files are stored on the workstation connected to the affected genetic analyzer instrument. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 8.3 (AV:L/AC:L/AT:N/PR:N/UI:N with VI:H/VA:H and SI:H) reflects low attack complexity and no authentication requirement once file system access exists, but the local attack vector (AV:L) substantially limits the exposed attack surface compared to network-exploitable vulnerabilities. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A lab technician or insider adversary with standard user access to the workstation connected to a forensic DNA analyzer opens a .hid output file in a hex editor or .fsa-compatible viewer and alters allele peak calls to match a desired DNA profile. Because the GeneMapper ID-X software performs no signature or checksum validation on import, it processes the modified file identically to authentic instrument output, and the falsified STR profile is reported as a match or exclusion in a case report. … |
| Remediation | Consult the Thermo Fisher vendor bulletin at https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf and CISA ICSMA-26-216-01 at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-26-216-01 for vendor-recommended patched versions; the version caps listed in EUVD indicate the last vulnerable versions for each product line, and upgraded releases may be available. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit and restrict write access to all .fsa and .hid output file repositories to authenticated instruments only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-353 – Missing Support for Integrity Check
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today