title: 3.2.1 EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250
description: LRM utilizes elevated privileges. An unauthenticated malicious actor can upload and execute code remotely at the operating system level, which can allow an attacker to change settings, configurations, software, or access sensitive data on the affected produc. An attacker could also exploit this vulnerability to access APIs not intended for general use and interact through the network.
problem types: cwe-250
affected:
{
product: NextSeq 550Dx
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
{
product: MiSeq Dx
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
{
product: NextSeq 500 Instrument
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
{
product: NextSeq 550 Instrument
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
{
product: MiSeq Instrument
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
{
product: iSeq 100 Instrument
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
{
product: MiniSeq Instrument
vendor: Illumina
versions:
status: affected, version: LRM Versions 1.3 to 3.1
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: HIGH
baseScore: 10
baseSeverity: CRITICAL
confidentialityImpact: HIGH
integrityImpact: HIGH
privilegesRequired: NONE
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
version: 3.1
]