Thermo Fisher Ion Torrent OneTouch 2 INS1005527 Access Control List access control

Summaryinfo

A vulnerability described as critical has been identified in Thermo Fisher Ion Torrent OneTouch 2 INS1005527. This vulnerability affects unknown code of the component Access Control List Handler. Such manipulation leads to access control. This vulnerability only affects products that are no longer supported by the maintainer. This vulnerability is traded as CVE-2025-54304. The attack may be launched remotely. There is no exploit available.

Detailsinfo

A vulnerability was found in Thermo Fisher Ion Torrent OneTouch 2 INS1005527. It has been rated as critical. Affected by this issue is an unknown code block of the component Access Control List Handler. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality, integrity, and availability. CVE summarizes:

An issue was discovered on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. When they are powered on, an X11 display server is started. The display server listens on all network interfaces and is accessible over port 6000. The X11 access control list, by default, allows connections from 127.0.0.1 and 192.168.2.15. If a device is powered on and later connected to a network with DHCP, the device may not be assigned the 192.168.2.15 IP address, leaving the display server accessible by other devices on the network. The exposed X11 display server can then be used to gain root privileges and the ability to execute code remotely by interacting with matchbox-desktop and spawning a terminal. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

The advisory is shared for download at assets.thermofisher.com. This vulnerability is handled as CVE-2025-54304 since 07/18/2025. The exploitation is known to be easy. The attack may be launched remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 12/04/2025). The MITRE ATT&CK project declares the attack technique as T1068.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Peer-to-Peer Software

Vendor

• Thermo Fisher

Name

• Ion Torrent OneTouch 2

Version

• INS1005527

Support

• end of life

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion