Thermo Fisher Applied Biosystems Genetic Analyzers

The Applied Biosystems 3500 and 3500xL Series are genetic analyzers used for DNA analysis. CISA's advisory covers one vulnerability in Data Collection Software below 4.0.2. It's a clear diagnostic-integrity case.

The published vector needs no privileges and no user action, but requires local access. That's why Exploitability reads Medium. Integrity impact is High on both the analyzer and downstream systems. On Blue Goat's security matrix, that's High as published.

The published vectors describe the product as CISA scored it, not your device. If you build on this product or a similar component, score your own deployment with the CVSS v4.0 environmental metrics before you rate your risk.

An attacker doesn't have to break into a device to harm a patient. Changing the data a diagnosis rests on is enough. Any device that writes results to files another system reads should protect those files from undetected change.

What to check now

1. Check whether your result and output files carry integrity protection, such as digital signatures, from creation to the system that reads them.
2. Confirm that downstream software rejects altered files.
3. For Applied Biosystems 3500 and 3500xL users, update Data Collection Software to version 4.0.3. Thermo Fisher's update adds digital signatures.
4. If you're not affected, record that in a VEX statement with the justification.
5. Re-score each affected threat in your cybersecurity risk assessment, and carry any patient-harm result into your ISO 14971 file.

This analysis is informational. It is based on CISA's published advisory and does not assess any specific manufacturer's device.