Thermo Fisher Torrent Suite Software
MonitorCVSS 6.5ICS-CERT ICSMA-26-288-01Oct 15, 2026
Emerson
Attack path
Attack VectorNetwork
Auth RequiredLow
ComplexityLow
User InteractionNone needed
Summary
Torrent Suite Software versions 5.18 and earlier contain a path traversal vulnerability (CWE-22) that allows an authenticated attacker to read arbitrary files on the Torrent Server.
What this means
What could happen
An attacker with valid credentials could read sensitive files from your Torrent Server, potentially exposing sequencing data, analysis results, or system configuration details stored on the server.
Who's at risk
This affects genomics and sequencing laboratories that operate Thermo Fisher Torrent Suite Software for next-generation sequencing analysis. Anyone with system access to genomics workstations or servers running Torrent Suite is at risk if the application is exposed to users with authentication credentials.
How it could be exploited
An attacker with valid engineering or operator credentials logs into Torrent Suite Software and uses a path traversal attack (directory traversal using relative paths like "../../../etc/") to access files outside their intended directory scope on the Torrent Server. The attacker can then read and exfiltrate arbitrary files from the server filesystem.
Prerequisites
- Valid user credentials (engineering workstation account or operator account)
- Network access to Torrent Suite Software web interface or API
- Torrent Suite Software version 5.18 or earlier running on the server
Remotely exploitableRequires valid credentials (low attack complexity)Affects data confidentiality on sequencing equipment
Exploitability
Unlikely to be exploited — EPSS score 0.3%
Affected products (1)
ProductAffected VersionsFix Status
Torrent Suite Software≤ 5.18Fix available
Remediation & Mitigation
0/3
Do now
0/1HARDENINGRestrict network access to Torrent Suite Software to only authorized genomics workstations and administrative systems using firewall rules or network segmentation
Schedule — requires maintenance window
0/2Patching may require device reboot — plan for process interruption
HOTFIXUpdate Torrent Suite Software to version 5.22 or later
HARDENINGReview user access and disable unnecessary accounts with Torrent Suite credentials
CVEs (1)
↑↓ Navigate · Esc Close
API:
/api/v1/advisories/46a0df14-f4be-4e50-95b5-778ef0abd251Get OTPulse briefings by email
Advisory breakdowns and incident analyses for the people actually defending OT environments. Sent when there's something worth your attention, not on a schedule. Free, no account required.