CVE-2022-1521

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

LRM does not implement authentication or authorization by default. A malicious actor can inject, replay, modify, and/or intercept sensitive data.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284 CWE-306 CWE-862

Affected software

Vendor	Product	Versions
Illumina	NextSeq 550Dx	LRM Versions 1.3 to 3.1
Illumina	MiSeq Dx	LRM Versions 1.3 to 3.1
Illumina	NextSeq 500 Instrumen	LRM Versions 1.3 to 3.1
Illumina	NextSeq 550 Instrument	LRM Versions 1.3 to 3.1
Illumina	MiSeq Instrument	LRM Versions 1.3 to 3.1
Illumina	iSeq 100 Instrument	LRM Versions 1.3 to 3.1
Illumina	MiniSeq Instrument	LRM Versions 1.3 to 3.1

References

https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02Third Party Advisory, US Government Resource
https://www.cisa.gov/uscert/ics/advisories/icsa-22-153-02Third Party Advisory, US Government Resource

Timeline

Published: Jun 24, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-15225.3The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-117: Improper Output Neutralization CVE-2022-15239.1Fuji Electric D300win prior to version 3.7.1.17 is vulnerable to a write-what-where condition, which could allow an attacker to overwrite pr CVE-2022-15245.9LRM version 2.4 and lower does not implement TLS encryption. A malicious actor can MITM attack sensitive data in-transit, including credenti CVE-2022-15259.1The Cognex 3D-A1000 Dimensioning System in firmware version 1.0.3 (3354) and prior is vulnerable to CWE-602: Client-Side Enforcement of Serv CVE-2022-15265.4A vulnerability, which was classified as problematic, was found in Emlog Pro up to 1.2.2. This affects the POST parameter handling of articl CVE-2022-15276.1The WP 2FA WordPress plugin before 2.2.1 does not sanitise and escape a parameter before outputting it back in an admin page, leading to a R CVE-2022-15286.1The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.5.9 does not escape the current URL before putting it back in a JavaScri CVE-2022-15298.8An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading t CVE-2022-15306.1Cross-site Scripting (XSS) in GitHub repository livehelperchat/livehelperchat prior to 3.99v. The attacker can execute malicious JavaScript CVE-2022-15319.8SQL injection vulnerability in ARAX-UI Synonym Lookup functionality in GitHub repository rtxteam/rtx prior to checkpoint_2022-04-20 . This v CVE-2022-15326.1Themify WordPress plugin before 1.3.8 does not sanitise and escape the page parameter before outputting it back in an attribute in an admin CVE-2022-15337.8Buffer Over-read in GitHub repository bfabiszewski/libmobi prior to 0.11. This vulnerability is capable of arbitrary code execution.