CVE-2025-54304
📋 TL;DR
This vulnerability allows remote attackers to gain root privileges and execute arbitrary code on Thermo Fisher Ion Torrent OneTouch 2 INS1005527 devices. The exposed X11 display server on port 6000 enables unauthenticated remote code execution. Only unsupported legacy devices are affected.
💻 Affected Systems
- Thermo Fisher Ion Torrent OneTouch 2 INS1005527
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root access, data exfiltration, device manipulation, and lateral movement to other network systems.
Likely Case
Unauthorized access to sensitive laboratory data, device tampering, and potential disruption of laboratory operations.
If Mitigated
Limited impact with proper network segmentation and access controls preventing exploitation.
🎯 Exploit Status
Exploitation involves connecting to X11 server and interacting with matchbox-desktop to spawn terminal with root privileges.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: N/A
Vendor Advisory: N/A
Restart Required: No
Instructions:
No official patch available as product is no longer supported by maintainer.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected devices in separate VLAN with strict firewall rules blocking port 6000 access.
X11 Access Control Restriction
linuxConfigure X11 to only allow connections from localhost and remove 192.168.2.15 rule.
xhost - 192.168.2.15
xhost + localhost
🧯 If You Can't Patch
- Physically disconnect devices from networks when not in use
- Implement strict network access controls and monitor port 6000 connections
🔍 How to Verify
Check if Vulnerable:
Check if port 6000 is listening on all interfaces: 'netstat -tlnp | grep :6000' or 'ss -tlnp | grep :6000'Check Version:
Device model check: Refer to physical device labeling or system documentationVerify Fix Applied:
Verify port 6000 is not accessible from network: 'nmap -p 6000 <device_ip>' should show filtered/closed📡 Detection & Monitoring
Log Indicators:
- X11 connection attempts from unauthorized IPs
- Unexpected root terminal spawns
Network Indicators:
- TCP connections to port 6000 from non-localhost addresses
- X11 protocol traffic on network
SIEM Query:
source_port=6000 OR dest_port=6000 AND (src_ip!=127.0.0.1 AND src_ip!=192.168.2.15)