External risk intelligence

Thermo Fisher Ion Torrent OneTouch 2 Weak SSH Password Allows Root Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-53963

The device is a laboratory instrument (Ion Torrent OneTouch 2) that provides SSH access. While the service is network-accessible, such specialized scientific laboratory equipment is typically deployed within internal, restricted laboratory networks and is not intended to be exposed to the public internet.

Thermofisher Ion Torrent Onetouch 2 Firmware

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified on certain Thermo Fisher Ion Torrent OneTouch 2 devices, allowing unauthorized network access to gain full control of the system due to a weak default password for the root account. This issue affects devices that are no longer supported by the manufacturer.

Weak default password allows system takeover.
Unmaintained devices pose persistent security risks.
Confirm relevance and assess exposure for unsupported systems.

Attack Path

How an attacker could exploit the issue

An attacker with network access to a Thermo Fisher Ion Torrent OneTouch 2 device can exploit a weak default password on the SSH server. This allows them to gain root-level command execution on the device.

Network access required.
Weak default SSH password.
Root code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability affects Thermo Fisher Ion Torrent OneTouch 2 devices running an SSH server. An attacker with network access could exploit a weak default password for the root account to gain full control of the device. This risk is limited to products that are no longer supported by the maintainer.

Root access to the device.
Network connectivity to the device.
Compromise of device functions.

Operational Fix

Recommended remediation, mitigation, and detection steps

Given that the affected Thermo Fisher Ion Torrent OneTouch 2 devices run an unsupported SSH server with a weak default password for the root account, immediate action is needed by the teams responsible for managing laboratory or specialized scientific instruments. The first practical step involves identifying all instances of this equipment, verifying their network reachability and criticality to research or operational workflows, locating the accountable owner, and then prioritizing remediation based on the identified risks.

Identify and confirm device ownership.
Verify network exposure and criticality.
Plan remediation for unsupported systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Thermo Fisher Ion Torrent OneTouch 2?

It is a laboratory instrument used for automated DNA template preparation in sequencing workflows. These systems rely on integrated software and firmware to manage scientific processes, and they often include network services like SSH to support administrative maintenance tasks.

What is the weakness in CVE-2025-53963?

This vulnerability is classified as Weak Password Requirements (CWE-521). It occurs because the device uses a predictable, hardcoded default password for the root administrative account and does not require users to change it, allowing anyone with the correct credentials to gain full control.

How does an attacker trigger this vulnerability?

An attacker initiates the trigger by connecting to the device's SSH service over the network. The vulnerability is specifically tied to the root account's weak credentials; it is not triggered by standard operational use of the scientific software or by physically interacting with the device's interface.

Is my device at risk if it is on an internal network?

According to Halo Surface Signal, these instruments are typically located on restricted laboratory networks rather than the public internet. While this reduces the likelihood of broad external scanning, anyone with network access to the device can exploit this weakness, meaning internal security is still essential.

How do I secure my system against this threat?

Since this issue affects unsupported hardware, you should first identify all instances of these devices in your environment. Evaluate their network connectivity and determine if they can be isolated from broader networks. Coordinate with your laboratory managers to assess the impact and plan for decommissioning or restricted access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.