External risk intelligence

Thermo Fisher Ion Torrent OneTouch 2 Networked X11 Server Vulnerability Allows Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-54304

The device is a laboratory instrument typically operated within private, isolated, or air-gapped laboratory networks. While the X11 server listens on network interfaces, it is designed for internal use. Exposure requires specific network misconfiguration where the device is placed on a broader, routable network rather than its intended segmented environment, making public internet exposure uncommon.

Information Disclosure

Thermofisher Ion Torrent Onetouch 2 Firmware

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical security flaw affecting Thermo Fisher Ion Torrent OneTouch 2 devices. The issue arises from an X11 display server that, under certain network conditions, can be accessed remotely. This access could allow unauthorized users to gain full control of the device, potentially leading to the execution of malicious code. The primary concern is confirming if any of these devices are deployed in a manner that exposes this vulnerability.

Unsecured display server on lab instruments.
Potential for unauthorized remote code execution.
Confirm relevance and exposure on your network.

Attack Path

How an attacker could exploit the issue

An attacker could gain root privileges and execute code remotely on an unsupported Thermo Fisher Ion Torrent OneTouch 2 device by exploiting an exposed X11 display server. This server starts when the device powers on and listens on all network interfaces, typically restricted to specific local IP addresses. However, if the device connects to a network with DHCP and doesn't receive its expected IP address, the X11 server can become accessible to other network devices, allowing an attacker to interact with the system and gain control.

Device powered on and connected to a network.
Exposed X11 server allows remote access.
Gain root privileges and execute code.

Live Threat

Current exploitation, exposure, and threat context

When an unsupported Thermo Fisher Ion Torrent OneTouch 2 device is powered on and connected to a network with DHCP, an X11 display server could become accessible on port 6000. This could allow an attacker to gain root privileges and execute code remotely by interacting with the desktop environment.

Root privileges and code execution.
Network access to an exposed server.
Unauthorized system control.

Operational Fix

Recommended remediation, mitigation, and detection steps

Thermo Fisher Ion Torrent OneTouch 2 devices are likely managed by laboratory or scientific instrument teams. The immediate first step is to identify all deployed devices, assess their network connectivity and criticality, and locate the asset owner. Subsequently, a risk-based remediation plan can be developed.

Instrument or Lab Operations teams should own resolution.
Verify network exposure and device criticality.
Plan for vendor-supported maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Thermo Fisher Ion Torrent OneTouch 2?

The Ion Torrent OneTouch 2 is a laboratory instrument designed for automated template preparation in next-generation sequencing workflows. It automates the process of attaching DNA samples to beads before they are loaded onto a sequencer. These systems rely on specialized firmware to manage their internal operations and user interface.

What does CWE-200 mean for CVE-2025-54304?

CWE-200 refers to Information Exposure. In the context of this CVE, it means the device unintentionally reveals internal system interfaces—specifically an X11 display server—to the network. Because access controls meant to restrict this server can fail during network assignment, unauthorized parties could potentially access the graphical interface and underlying system services.

How does an attacker trigger this vulnerability?

The vulnerability is triggered when the device is powered on and joins a network via DHCP, but fails to receive its intended 192.168.2.15 address. This causes the X11 server to remain reachable by other devices on the network. Simply keeping the device off a network or ensuring it is restricted to its designated local-only IP range prevents this specific access path.

Is my device at risk based on Halo Surface Signal?

According to Halo Surface Signal, risk is considered unlikely because these instruments are intended for private or air-gapped lab networks. You are only at significant risk if the device has been placed on a broader, routable network rather than a properly segmented laboratory environment, which makes it visible to unauthorized systems.

What should I do if I have these devices?

First, locate all Ion Torrent OneTouch 2 units within your facility and identify the teams responsible for their operation. Verify how these devices are currently networked to confirm they are isolated from general office or public networks. Since these products are no longer supported, consult your internal security team to develop a long-term plan for managing or retiring these systems.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.