CVE-2025-53963
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-16
Assigner: MITRE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| thermofisher | ion_torrent_onetouch_2_firmware | * |
| thermofisher | ion_torrent_onetouch_2 | * |
| thermofisher | ion_torrent_onetouch_2_firmware | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-521 | The product does not require that users should have strong passwords. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices, where the root account has a weak default password ('ionadmin') and there is no enforced policy to change this password. Because the devices run an SSH server accessible on the default port 22, an attacker with network access can use the weak password to gain root-level code execution on the device.
How can this vulnerability impact me? :
If you use the affected Thermo Fisher Ion Torrent OneTouch 2 devices, an attacker could remotely gain full control of the device by exploiting the weak root password. This could lead to unauthorized access, manipulation of device functions, data compromise, or disruption of services provided by the device.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
You can detect this vulnerability by scanning your network for devices running an SSH server on the default port 22, specifically Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. Checking if the root account uses the default weak password 'ionadmin' can be done by attempting to SSH into the device with that username and password. For example, use the command: ssh root@<device_ip> and enter 'ionadmin' as the password to test if the default password is still active.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include changing the root account password from the default 'ionadmin' to a strong, unique password. Since the product does not enforce a password change policy, manual password updates are necessary. Additionally, restrict network access to the SSH server by using firewalls or network segmentation to limit exposure. If possible, discontinue use of the affected unsupported devices or replace them with supported alternatives.