CISA warns of Thermo Fisher analyzer flaw that could alter DNA data files

CISA on Aug. 4 issued an advisory on CVE-2026-17583, a vulnerability in multiple Thermo Fisher Applied Biosystems Genetic Analyzers that could let an attacker modify output files and affect DNA data used in testing.

The agency said the issue matters because the files can be changed after generation, which could lead to inaccurate test results. CISA rated the flaw high severity, with a CVSS v3.1 base score of 8.4 and a CVSS v4.0 base score of 8.2.

CISA said the affected products include Applied Biosystems 3500/3500xL Series Data Collection Software versions 4.0.2 and earlier, 3730/3730xL Series Data Collection Software 5.0.2 and earlier, SeqStudio Genetic Analyzer Data Collection Software 1.2.5 and earlier, SeqStudio Flex Series Instrument Software 1.2.0 and earlier, GeneMapper ID-X Software v1.7.3 and earlier, 3130 Series Data Collection Software 4.1 and earlier, ABI PRISM 3100/3100-Avant Data Collection Software 2.0 and earlier, and ABI PRISM 310 Data Collection Software 3.1 and earlier.

The advisory said the vulnerability affects Thermo Fisher equipment worldwide and is tied to healthcare and public health use. CISA described the flaw as a missing integrity check, saying .fsa and .hid output files can be edited. Those file types are used in human identification workflows, and CISA said tampering could alter DNA data and produce inaccurate outcomes.

Thermo Fisher’s remediation guidance says security updates have been developed for some products and add digital signatures to help users verify that data files have not been modified. CISA listed the fixed versions as 3500/3500xL 4.0.3, 3730/3730xL 5.0.3, SeqStudio Genetic Analyzer 1.2.6, SeqStudio Flex Series Instrument Software 1.2.1, and GeneMapper ID-X 1.7.4.

For 3130 Series Data Collection Software, ABI PRISM 3100/3100-Avant Data Collection Software, and ABI PRISM 310 Data Collection Software, CISA said the products are end of life and no update is available.

CISA said no known public exploitation specifically targeting the flaw has been reported to the agency and said the vulnerability is not remotely exploitable. Thermo Fisher recommended keeping a secure chain of custody for HID-generated files, storing them on encrypted password-protected media, limiting access to authorized staff, applying least privilege on affected systems, and using firewall rules and NACLs to restrict internet connectivity to trusted sources.

CISA also advised minimizing network exposure, using VPNs when remote access is required, performing impact analysis and risk assessment before deploying defenses, and reporting suspected malicious activity to CISA. The advisory acknowledged Nathaniel Adams, Laura Gaydosh-Combs, and Kevin Dyer for reporting the vulnerability.

Users of affected software will need to move to the updated versions where available or rely on compensating controls for end-of-life products. CISA’s advisory remains the main public guidance as operators review the affected software versions and file-handling controls.

Sources

• CISA Cybersecurity Advisories
• CISA RSS raw payload

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.