Thermo Fisher Applied Biosystems HID Software Missing Integrity Verification on .fsa/.hid DNA Data Files

CVE-2026-17583 is a missing-integrity-verification flaw in Thermo Fisher Scientific's Applied Biosystems Human Identification software — the instruments and analysis tools that produce .fsa and .hid DNA data files for forensic crime labs, paternity testing, and clinical genetics. Because these file formats never included digital signatures or checksums, an attacker with access to the laboratory file server can modify DNA analysis output files before they're loaded into interpretation software like GeneMapper ID-X, and the software will accept the tampered data without any warning. Researchers demonstrated combining two DNA profiles into a single file that appeared unmodified since 2015. Affected Data Collection Software versions include 3500/3500xL ≤4.0.2, 3730/3730xL ≤5.0.2, SeqStudio ≤1.2.5, SeqStudio Flex ≤1.2.0, and GeneMapper ID-X ≤1.7.3. Three end-of-life product lines (3130, ABI PRISM 3100/3100-Avant, ABI PRISM 310) will receive no patch.

The vendor-assigned CVSS v4.0 score of 8.2 (High) reflects the seriousness of undetectable evidence tampering, and that's fair *within the forensic-lab domain*. But for a general enterprise security team managing 10,000 Windows/Linux hosts, this score dramatically overstates urgency. The affected software runs on a tiny population of purpose-built genetic analyzer workstations in accredited laboratories — not on domain controllers, application servers, or user endpoints. The attack requires authenticated access to lab file storage and specialized knowledge of DNA analysis workflows. There is no code execution, no lateral movement, and no privilege escalation. The 8.2 is a domain-specific integrity score, not an enterprise-IT risk score.

Why this verdict

• Negligible enterprise footprint: Applied Biosystems genetic analyzers are specialized laboratory instruments. A typical enterprise IT environment has zero instances. Even hospital systems have these only in dedicated genetics departments on segmented lab networks.
• Authenticated local/network access required: The attacker must already have valid credentials to the lab file server or physical access to the instrument workstation — this is a post-compromise prerequisite that assumes prior breach of a segmented lab environment.
• No code execution or propagation: This is a pure data-integrity flaw. There is no RCE, no privilege escalation, no lateral movement capability. The blast radius is confined to the integrity of .fsa/.hid files on a single lab system.
• Role multiplier: The affected component is a laboratory instrument controller — it does not appear in any high-value enterprise role (not a DC, hypervisor, CI/CD, backup, network edge, IdP, or kernel-mode agent). The blast radius is *evidence integrity* within a single lab workflow, not fleet compromise. For the <0.1% of enterprises that are forensic labs, the integrity impact is severe but still bounded to the lab data tier.
• Procedural controls exist independently: Accredited forensic labs operate under ISO 17025 and FBI QAS standards with chain-of-custody controls, dual-analyst review, and physical access restrictions that provide defense-in-depth beyond the software layer.

Why not higher?

Upgrading to HIGH would require either a broader installed base, code execution capability, or evidence of active exploitation — none of which exist. The affected systems are offline laboratory instruments with no internet exposure, the attack requires authenticated access plus specialized genetics knowledge, and the impact cannot cascade beyond the lab's data files. No threat actor has demonstrated interest.

Why not lower?

Downgrading to LOW or IGNORE would understate the risk for organizations that *do* operate forensic genetics labs, where undetected evidence tampering could undermine criminal prosecutions or clinical diagnoses. The 30-year window of unprotected files and three EOL product lines with no patch available mean some organizations face a real remediation gap. The CISA coordination also signals legitimate concern.

1. Deploy file integrity monitoring on lab instrument output directories — Configure FIM (Tripwire, OSSEC, Wazuh, or similar) on all directories where genetic analyzers write .fsa and .hid files. Alert on any modification after initial file creation. This is your primary compensating control and should be deployed within the noisgate remediation window of 365 days for MEDIUM findings.
2. Enable write-once storage for instrument output — Configure instrument output directories to use WORM (Write Once Read Many) storage or immutable file flags. On Windows, use NTFS permissions to grant the instrument service account write-only and analysts read-only access. This prevents post-creation tampering regardless of patch status.
3. Segment lab networks from corporate IT — If not already segmented, place genetic analyzer workstations and their file storage on a dedicated VLAN with no inbound access from the corporate network. This is standard for accredited labs but verify the control is in place.
4. Patch supported products to signature-enabled versions — Update to 3500/3500xL DCS 4.0.3, 3730/3730xL DCS 5.0.3, SeqStudio GA DCS 1.2.6, SeqStudio Flex 1.2.1, and GeneMapper ID-X 1.7.4. These versions add digital signatures to output files. Coordinate patching with lab operations to avoid disrupting active casework.
5. Plan EOL instrument replacement — The 3130, ABI PRISM 3100/3100-Avant, and ABI PRISM 310 will receive no patch. Begin procurement planning for replacement instruments. Until replaced, these must rely entirely on FIM and procedural controls.

Run this script on each Applied Biosystems instrument workstation or file server as a local administrator. It checks installed software versions against the patched baselines. Example: .\Check-CVE-2026-17583.ps1

#Requires -Version 5.1
<#
  Check-CVE-2026-17583.ps1
  Checks for Thermo Fisher Applied Biosystems software affected by CVE-2026-17583.
  Run on instrument workstations as local admin.
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'SilentlyContinue'
$found = $false
$vulnerable = $false

# Define affected products and their fixed versions
$products = @(
    @{ Pattern = '3500.*Data Collection'; FixedMajor = 4; FixedMinor = 0; FixedBuild = 3; Name = '3500/3500xL DCS' },
    @{ Pattern = '3730.*Data Collection'; FixedMajor = 5; FixedMinor = 0; FixedBuild = 3; Name = '3730/3730xL DCS' },
    @{ Pattern = 'SeqStudio.*Genetic.*Data Collection'; FixedMajor = 1; FixedMinor = 2; FixedBuild = 6; Name = 'SeqStudio GA DCS' },
    @{ Pattern = 'SeqStudio.*Flex'; FixedMajor = 1; FixedMinor = 2; FixedBuild = 1; Name = 'SeqStudio Flex' },
    @{ Pattern = 'GeneMapper.*ID-X'; FixedMajor = 1; FixedMinor = 7; FixedBuild = 4; Name = 'GeneMapper ID-X' }
)

# EOL products (always vulnerable, no patch)
$eolPatterns = @('3130', 'ABI PRISM 3100', 'ABI PRISM 310')

$regPaths = @(
    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*',
    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'
)

$installed = Get-ItemProperty $regPaths 2>$null | Where-Object { $_.DisplayName -match 'Applied Biosystems|Thermo Fisher|GeneMapper|SeqStudio|3500|3730|3130|ABI PRISM' }

foreach ($app in $installed) {
    # Check EOL products
    foreach ($eol in $eolPatterns) {
        if ($app.DisplayName -match $eol) {
            Write-Host "[VULNERABLE] EOL product found: $($app.DisplayName) - NO PATCH AVAILABLE" -ForegroundColor Red
            $found = $true
            $vulnerable = $true
        }
    }
    # Check patchable products
    foreach ($prod in $products) {
        if ($app.DisplayName -match $prod.Pattern) {
            $found = $true
            try {
                $ver = [version]$app.DisplayVersion
                $fixed = [version]("$($prod.FixedMajor).$($prod.FixedMinor).$($prod.FixedBuild)")
                if ($ver -lt $fixed) {
                    Write-Host "[VULNERABLE] $($prod.Name) v$($app.DisplayVersion) < $fixed" -ForegroundColor Red
                    $vulnerable = $true
                } else {
                    Write-Host "[PATCHED] $($prod.Name) v$($app.DisplayVersion) >= $fixed" -ForegroundColor Green
                }
            } catch {
                Write-Host "[UNKNOWN] $($prod.Name) - could not parse version: $($app.DisplayVersion)" -ForegroundColor Yellow
            }
        }
    }
}

if (-not $found) {
    Write-Host "[UNKNOWN] No Applied Biosystems / Thermo Fisher HID software detected on this host." -ForegroundColor Yellow
    exit 2
}
if ($vulnerable) {
    Write-Host "`nResult: VULNERABLE" -ForegroundColor Red
    exit 1
} else {
    Write-Host "`nResult: PATCHED" -ForegroundColor Green
    exit 0
}

Sources

1. The Hacker News — Thermo Fisher Patches Flaw
2. Thermo Fisher Security Bulletin (PDF)
3. Tenable CVE Entry
4. Rescana Advisory
5. CybersecurityNews Coverage
6. GBHackers Coverage
7. Daily Security Review