VulnHub

Real-time Cybersecurity News

Critical

Thermo Fisher Applied Biosystems Genetic Analyzers

All CISA Advisories
CVEVulnerabilityUpdateCritical

Overview

A serious vulnerability has been identified in several Thermo Fisher Applied Biosystems Genetic Analyzers, which could allow attackers to tamper with DNA data by modifying output files. This flaw affects multiple versions of their software, including the 3500 Series, 3730 Series, SeqStudio, and GeneMapper ID-X, among others. The risk is significant because altered DNA test results could lead to incorrect diagnoses and treatments in healthcare settings. To mitigate the issue, Thermo Fisher has released security updates that implement digital signatures to ensure data integrity. Users are advised to update their software to the latest versions as soon as possible and to follow interim measures to secure their data until the updates can be applied.

Key Takeaways

  • Affected Systems: Thermo Fisher Applied Biosystems 3500/3500xL Series Data Collection Software <=4.0.2, Applied Biosystems 3730/3730xL Series Data Collection Software <=5.0.2, SeqStudio Genetic Analyzer Data Collection Software <=1.2.5, SeqStudio Flex Series Instrument Software <=1.2.0, GeneMapper ID-X Software <=v1.7.3, 3130 Series Data Collection Software <=4.1, ABI PRISM 3100/3100-Avant Data Collection Software <=2.0, ABI PRISM 310 Data Collection Software <=3.1.
  • Action Required: Thermo Fisher has provided security updates: Applied Biosystems 3500/3500xL Series Data Collection Software update to version 4.
  • Timeline: Disclosed on 2026-08-04

Original Article Summary

View CSAF Summary Successful exploitation of this vulnerability could allow an attacker to modify .fsa/.hid output files, tampering with DNA data and resulting in inaccurate test results. The following versions of Thermo Fisher Applied Biosystems Genetic Analyzers are affected: Applied Biosystems 3500/3500xL Series Data Collection Software <=4.0.2 Applied Biosystems 3730/3730xL Series Data Collection Software <=5.0.2 Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software <=1.2.5 Applied Biosystems SeqStudio Flex Series Instrument Software <=1.2.0 Applied Biosystems GeneMapper ID-X Software <=v1.7.3 Applied Biosystems 3130 Series Data Collection Software <=4.1 ABI PRISM 3100/3100-Avant Data Collection Software <=2.0 ABI PRISM 310 Data Collection Software <=3.1 CVSS Vendor Equipment Vulnerabilities v3 8.4 Thermo Fisher Thermo Fisher Applied Biosystems Genetic Analyzers Missing Support for Integrity Check Background Critical Infrastructure Sectors: Healthcare and Public Health Countries/Areas Deployed: Worldwide Company Headquarters Location: United States Vulnerabilities Expand All + CVE-2026-17583 The affected product is vulnerable because its .fsa/.hid output files can be edited. An attacker could tamper with these files, altering DNA data and resulting in inaccurate DNA test outcomes. View CVE Details Affected Products Thermo Fisher Applied Biosystems Genetic Analyzers Vendor: Thermo Fisher Product Version: Thermo Fisher Applied Biosystems 3500/3500xL Series Data Collection Software: <=4.0.2, Thermo Fisher Applied Biosystems 3730/3730xL Series Data Collection Software: <=5.0.2, Thermo Fisher Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software: <=1.2.5, Thermo Fisher Applied Biosystems SeqStudio Flex Series Instrument Software: <=1.2.0, Thermo Fisher Applied Biosystems GeneMapper ID-X Software: <=v1.7.3, Thermo Fisher Applied Biosystems 3130 Series Data Collection Software: <=4.1, Thermo Fisher ABI PRISM 3100/3100-Avant Data Collection Software: <=2.0, Thermo Fisher ABI PRISM 310 Data Collection Software: <=3.1 Product Status: known_affected Remediations Mitigation Thermo Fisher has developed security updates to address the vulnerability. The security updates implement the use of digital signatures on the instrument software that adds an extralayer of protection. Moving forward, this will help users verify that data files have not been modified. Vendor fix Applied Biosystems 3500/3500xL Series Data Collection Software: Update to version 4.0.3 https://downloads.thermofisher.com/3500_DCS_v4.0.3_Patch/v4.0.3_Patch_Installer.exe Vendor fix Applied Biosystems 3730/3730xL Series Data Collection Software: Update to version 5.0.3 https://downloads.thermofisher.com/3730xl_UDC_v5.0.3_Patch/3730xl_UDC_v5.0.3_Patch.exe Vendor fix Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software: Update to version 1.2.6 https://downloads.thermofisher.com/SeqStudio/1.2.6/SeqStudio-1.2.6.abpkg Vendor fix Applied Biosystems SeqStudio Flex Series Instrument Software: Update to version 1.2.1 https://downloads.thermofisher.com/SeqStudioFlex/1.2.1/SeqStudioFlex-1.2.1.abpkg Vendor fix Applied Biosystems GeneMapper ID-X Software: Update to version 1.7.4 https://downloads.thermofisher.com/GeneMapperID-Xv1.7.4_Patch/GMIDX_v1.7.4_Patch.exe Vendor fix Applied Biosystems 3130 Series Data Collection Software: Product is End of Life (EoL), no update provided Vendor fix ABI PRISM 3100/3100-Avant Data Collection Software: Product is End of Life (EoL), no update provided Vendor fix ABI PRISM 310 Data Collection Software: Product is End of Life (EoL), no update provided Mitigation For users who are unable to immediately implement all applicable security updates, Thermo Fisher Scientific recommends implementing the following interim mitigation measures until the applicable updates have been installed: -Maintain a secure chain of custody for files generated by the HID instrumentation throughout the analysis workflow. -Store generated files on encrypted, password-protected storage media (for example, encrypted USB drives or encrypted hard drives). -Restrict access to generated files to authorized personnel in accordance with your laboratory's access control policies. -Apply the principle of least privilege by limiting user permissions on systems operating the HID instrumentation or hosting associated data analysis and secondary analysis software. -Leverage firewall rules and network access control lists (NACLs) to restrict internet connectivity to only trusted sources. Mitigation For more information, refer to Thermo Fisher's security bulletin. https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/fsa_hid_bulletin.pdf Relevant CWE: CWE-353 Missing Support for Integrity Check Metrics CVSS Version Base Score Base Severity Vector String 3.1 8.4 HIGH CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H 4.0 8.2 HIGH CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N Acknowledgments Nathaniel Adams, Laura Gaydosh-Combs, and Kevin Dyer reported this vulnerability to CISA Legal Notice and Terms of Use This product is provided subject to this Notification (https://www.cisa.gov/notification) and this Privacy & Use policy (https://www.cisa.gov/privacy-policy). Recommended Practices CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability. Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet. When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices. CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies. CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets. Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B--Targeted Cyber Intrusion Detection and Mitigation Strategies. Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents. No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. Revision History Initial Release Date: 2026-08-04 Date Revision Summary 2026-08-04 1 Initial Publication Legal Notice and Terms of Use

Impact

Thermo Fisher Applied Biosystems 3500/3500xL Series Data Collection Software <=4.0.2, Applied Biosystems 3730/3730xL Series Data Collection Software <=5.0.2, SeqStudio Genetic Analyzer Data Collection Software <=1.2.5, SeqStudio Flex Series Instrument Software <=1.2.0, GeneMapper ID-X Software <=v1.7.3, 3130 Series Data Collection Software <=4.1, ABI PRISM 3100/3100-Avant Data Collection Software <=2.0, ABI PRISM 310 Data Collection Software <=3.1.

Exploitation Status

No active exploitation has been reported at this time. However, organizations should still apply patches promptly as proof-of-concept code may exist.

Timeline

Disclosed on 2026-08-04

Remediation

Thermo Fisher has provided security updates: Applied Biosystems 3500/3500xL Series Data Collection Software update to version 4.0.3, 3730/3730xL Series update to version 5.0.3, SeqStudio update to version 1.2.6, SeqStudio Flex update to version 1.2.1, GeneMapper ID-X update to version 1.7.4. For users unable to update immediately, interim measures include maintaining secure file custody, using encrypted storage, restricting access to authorized personnel, limiting user permissions, and applying firewall rules to restrict internet connectivity.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Update, and 1 more.

Read Original Article

Related Coverage

Palo Alto Networks warns of PAN-OS RCE flaw exploited in attacks

BleepingComputer

Palo Alto Networks has identified a serious vulnerability in its PAN-OS, labeled CVE-2026-0322, which allows for remote code execution (RCE). This flaw is particularly concerning as it has already been exploited in attacks focusing on their firewall products. Users of Palo Alto's firewalls are at risk, as attackers can potentially gain unauthorized access and control over affected systems. To address this issue, Palo Alto Networks has issued security updates, urging users to apply them promptly to safeguard their networks. This incident highlights the ongoing challenges organizations face in securing their infrastructure against emerging cyber threats.

Oct 14, 2026

Anthropic 'SneakPeek' Flaw Is a Silent Zero-Click Threat

darkreading

A vulnerability has been discovered in the preview pane of Claude Code Desktop, which could allow attackers to steal sensitive credentials from developers without any interaction required. This zero-click flaw poses a significant risk as it can extract SSH private keys, AWS credentials, and Claude OAuth tokens quietly. Developers using this software may unknowingly expose their credentials, leading to potential unauthorized access to their systems and services. This incident raises concerns about the security of development tools and the need for heightened vigilance among users. It's crucial for developers to stay informed about this vulnerability and take necessary precautions to protect their sensitive information.

Oct 14, 2026

FBI raids DPRK IT worker laptop farms in Texas, US nationals arrested

BleepingComputer

The U.S. Department of Justice has taken significant action against the Famous Chollima group, which is linked to North Korean IT workers allegedly engaged in remote schemes. Two individuals were arrested, and 14 others have been charged, with authorities seizing nearly 187 laptops that were reportedly used in these operations. This crackdown is part of broader efforts to combat North Korean cyber activities that threaten U.S. interests and the global cybersecurity landscape. The operation underscores the ongoing challenges posed by state-sponsored cyber activities and the need for vigilance in monitoring such threats. The arrests and seizures may disrupt the group's operations and deter similar activities in the future.

Oct 14, 2026

Ledger asks sellers across Asia to halt sales after supply-chain attack

BleepingComputer

Ledger, a well-known cryptocurrency wallet manufacturer, has initiated a halt on sales of its devices across several Asian countries, including Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong. This decision comes amid concerns about potential tampering with the devices in the supply chain. Ledger has reached out to resellers and distributors, urging them to remove affected products from their shelves while the company conducts a thorough investigation. This situation raises significant concerns for users who rely on these wallets for secure cryptocurrency storage, as compromised devices could lead to unauthorized access to their funds. The company’s proactive approach aims to ensure the integrity of its products and protect its customers from possible security risks.

Oct 14, 2026

Cisco patches new Secure Email Gateway zero-day exploited in attacks

BleepingComputer

Cisco has issued a critical patch for a zero-day vulnerability in its Secure Email Gateway (SEG) that has been actively exploited by attackers. This flaw allows remote, unauthenticated users to execute commands with root privileges, posing a significant risk to organizations using the affected software. The vulnerability is particularly concerning as it can lead to unauthorized access and control over email systems, potentially compromising sensitive data. Users of Cisco's SEG are urged to apply the available patches immediately to safeguard their systems against these attacks. The situation emphasizes the need for timely updates and vigilance in protecting email infrastructures from evolving threats.

Oct 14, 2026

U.S. Shuts Down Over 40 Laptop Farms, Charges 14 in North Korean IT Worker Fraud

The Hacker News

The U.S. Department of Justice has charged 14 individuals and seized around 187 computers in a crackdown on a North Korean scheme that involved fraudulent remote IT workers. This operation targeted a conspiracy that impacted over 70 U.S. companies, with the accused facing charges related to wire fraud. The defendants include both U.S. citizens and Chinese nationals, highlighting the international dimension of the fraud. By disrupting this scheme, the U.S. aims to prevent North Korea from generating revenue through illegal means, which could potentially support its nuclear weapons program. This case underscores the ongoing challenges posed by state-sponsored cybercrime and the importance of international cooperation in addressing such threats.

Oct 14, 2026