OTPulse

Thermo Fisher Applied Biosystems Genetic Analyzers

Plan PatchCVSS 8.4ICS-CERT ICSMA-26-216-01Aug 4, 2026
Emerson
Attack path
Attack VectorLocal
Auth RequiredNone
ComplexityLow
User InteractionNone needed
Summary

Thermo Fisher Applied Biosystems genetic analyzer data collection software contains a file integrity vulnerability. An attacker with local access could modify .fsa/.hid output files containing DNA sequence data without detection. The affected products lack digital signature verification on output files, allowing modification of test results. Thermo Fisher has released security updates that implement digital signatures to verify file integrity and prevent tampering. Multiple data collection software versions for the 3500/3500xL, 3730/3730xL, SeqStudio Genetic Analyzer, SeqStudio Flex, and GeneMapper ID-X products are affected.

What this means
What could happen
An attacker with local access to a genetic analyzer computer could modify DNA test result files without detection, causing inaccurate or fraudulent test results that could affect patient care or forensic investigations.
Who's at risk
Clinical and forensic laboratories using Thermo Fisher Applied Biosystems genetic analyzers for DNA sequencing and analysis. This affects organizations that rely on test result integrity for patient care, forensic investigations, or paternity testing. Equipment includes the 3500/3500xL, 3730/3730xL, SeqStudio, and ABI PRISM series instruments.
How it could be exploited
An attacker with local access to the data collection computer could directly modify .fsa/.hid output files containing DNA sequence data. The vulnerability lacks file integrity verification, so modifications would not be detected until after analysis or reporting.
Prerequisites
  • Local access to the genetic analyzer data collection computer
  • Write access to the output file directories on the instrument or connected computer
affects laboratory safety and result integrityno authentication required for local file modificationlow attack complexity
Exploitability
Unlikely to be exploited — EPSS score 0.2%
Public Proof-of-Concept (PoC) on GitHub (1 repository)
Affected products (8)
8 with fix
ProductAffected VersionsFix Status
Applied Biosystems 3500/3500xL Series Data Collection Software≤ 4.0.24.0.3
Applied Biosystems 3730/3730xL Series Data Collection Software≤ 5.0.25.0.3
Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software≤ 1.2.51.2.6
Applied Biosystems SeqStudio Flex Series Instrument Software≤ 1.2.01.2.1
Applied Biosystems GeneMapper ID-X Software≤ v1.7.31.7.4
Applied Biosystems 3130 Series Data Collection Software≤ 4.1Fix available
ABI PRISM 3100/3100-Avant Data Collection Software≤ 2.0Fix available
ABI PRISM 310 Data Collection Software≤ 3.1Fix available
Remediation & Mitigation
0/6
Do now
0/2
HARDENINGRestrict physical access to genetic analyzer computers to authorized laboratory personnel only
HARDENINGEnable operating system access controls and file permissions to limit write access to output file directories
Schedule — requires maintenance window
0/4

Patching may require device reboot — plan for process interruption

Applied Biosystems 3500/3500xL Series Data Collection Software
HOTFIXUpdate Applied Biosystems 3500/3500xL Series Data Collection Software to version 4.0.3 or later
Applied Biosystems 3730/3730xL Series Data Collection Software
HOTFIXUpdate Applied Biosystems 3730/3730xL Series Data Collection Software to version 5.0.3 or later
Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software
HOTFIXUpdate Applied Biosystems SeqStudio Genetic Analyzer Data Collection Software to version 1.2.6 or later
Applied Biosystems SeqStudio Flex Series Instrument Software
HOTFIXUpdate Applied Biosystems SeqStudio Flex Series Instrument Software to version 1.2.1 or later
View full CISA ICS-CERT advisory
API: /api/v1/advisories/b06efe98-9d3c-465a-bf0e-113887582ac7

Get OT security insights every Tuesday

Advisory breakdowns, a weekly summary, and incident analyses for the people actually defending OT environments. Free, no account required.

Thermo Fisher Applied Biosystems Genetic Analyzers | CVSS 8.4 - OTPulse