CVE-2025-54304

When the device is powered on, an X11 server is automatically launched, which listens on all network interfaces on port 6000. The X11 server's default access control list (ACL) allows connections only from addresses 127.0.0.1 and 192.168.2.15. The problem occurs when the device is connected to a network with DHCP after startup — it may then receive an IP address different from 192.168.2.15, and the X11 server remains accessible to other devices on the network without any additional verification. An attacker gaining access to the X11 server can interact with the matchbox-desktop manager, launch a terminal, and thus execute arbitrary code with root privileges.

An unauthenticated attacker can obtain full root privileges on the device and remotely execute arbitrary code (RCE), resulting in complete loss of confidentiality, integrity, and availability of the system.

The manufacturer does not provide patches because the product is no longer supported. It is recommended to isolate devices from the network or implement network segmentation (firewall, dedicated VLAN) that prevents access to port 6000/TCP from outside. If device usage is necessary, ensure that after startup and before connecting to the DHCP network, the device obtains the IP address 192.168.2.15, or implement network-level access control that blocks traffic to port 6000. It is recommended to retire the devices from service and replace them with supported equivalents.

Thermo Fisher Ion Torrent OneTouch 2 (model INS1005527) — affects the firmware and the device itself. The manufacturer no longer supports these devices.