The exposed X11 display server on end-of-life Thermo Fisher Ion Torrent OneTouch 2 devices allows unauthenticated attackers to gain root access and execute arbitrary code.

The device starts an X11 display server that improperly restricts network access. This allows unauthenticated remote users to interact with the desktop environment and spawn terminals with root privileges.

The CVSS score of 9.8 underscores the critical nature of this flaw. Because the product is no longer supported, the risk is permanent and significant, as the device is highly susceptible to full compromise by any actor with network reach to port 6000.

Immediate Action: Since the product is unsupported, the only effective remediation is to disconnect these devices from the network or place them behind a restrictive firewall that blocks all unsolicited inbound traffic.

Proactive Monitoring: Monitor internal network traffic for connections to port 6000 on legacy laboratory equipment.

Compensating Controls: Physically isolate affected devices from the internet and untrusted network segments.

Public Exploit Available: Unknown.

Because the product is EOL, patching is not an option. Organizations must treat these devices as inherently insecure and ensure they are physically or logically air-gapped from the production network to prevent potential exploitation.