CVE-2026-17583

The .fsa and .hid output files from Thermo Fisher genetic analyzers contain no cryptographic integrity binding. This is not a buffer overflow or injection flaw — it is a design-level failure where the instrument will read and display modified files as if they were authentic. Anyone with filesystem access can alter a result file, and the instrument provides no mechanism to detect the tampering. There is no tamper-evident log, no hash verification, no signature check. The fraud is silent. The CVSS score of 8.4 mischaracterizes the risk. These instruments operate in criminal forensics labs, clinical diagnostic workflows, and research environments where their output directly determines legal outcomes and patient care decisions. The question is not merely whether a file can be modified — it is whether the entire evidentiary and diagnostic pipeline has been built on the implicit assumption that instrument output is inherently trustworthy, when in fact no integrity protection exists at the file level. The regulatory gap is real but not absolute. 21 CFR Part 11 and ISO 17025 already require audit trails and electronic signatures for records used in regulated decisions — but vendors have interpreted "record" to mean the LIMS or middleware layer, not the raw instrument output file. That interpretation is the actual vulnerability: a narrow reading that excludes the file format from integrity requirements. For immediate detection, implement a sidecar integrity manifest — an HMAC-signed hash log maintained by the data management software that records the instrument file's state at ingestion. This provides cryptographic non-repudiation without requiring instrument firmware changes. For long-term remediation, output file signing must be weighed against backward compatibility with existing lab workflows; this is a systemic redesign, not a patch. Disclosures should engage clinical and forensic stakeholders (CLSI, NIST forensic science committees) alongside traditional IT channels, because the failure is not in a single vendor's implementation but in an industry-wide assumption that integrity responsibility ends when data leaves the instrument.

Reviewed through automated stages and approved by a human before publication.