A critical vulnerability in the Thermo Fisher Ion Torrent OneTouch 2 device allows unauthenticated remote attackers to gain full root-level code execution.

The device ships with an SSH server enabled by default, utilizing a weak hardcoded root password ("ionadmin"). The lack of an enforced password change policy allows any attacker with network connectivity to the device to authenticate as root and execute arbitrary code.

With a CVSS score of 9.8, this vulnerability represents an extreme risk, as it allows full system compromise. An attacker gaining root access can exfiltrate data, install persistent backdoors, or use the device as a pivot point for further attacks on the internal network. The impact is compounded by the fact that the affected hardware is no longer supported by the vendor.

Immediate Action: Isolate the affected devices from all external networks and disable SSH access if it is not strictly required for current operations.

Proactive Monitoring: Audit network traffic for SSH connections (port 22) attempting to authenticate to these devices from unauthorized hosts.

Compensating Controls: Place the devices behind a strictly controlled firewall or within a segmented VLAN to ensure only authorized management workstations can communicate with them.

Public Exploit Available: N/A

Given that these devices are reportedly end-of-life and unsupported, the risk of exploitation is permanent. Organizations should prioritize decommissioning these devices or strictly isolating them from the production network to prevent potential compromise.