Vulnerability Description
The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to default deployments with the password ionadmin. The user guide recommends changing default credentials; however, a password change policy for default administrative accounts is not enforced. Many deployments may retain default credentials, in which case an attacker is likely to be able to successfully authenticate with administrative privileges.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Thermofisher | Torrent Suite Software | 5.18.1 |
Related Weaknesses (CWE)
References
- https://assets.thermofisher.com/TFS-Assets/LSG/manuals/MAN0026163-Torrent-Suite-ProductRelease Notes
- https://documents.thermofisher.com/TFS-Assets/CORP/Product-Guides/Ion_OneTouch_2Vendor Advisory
- https://www.thermofisher.com/us/en/home/life-science/sequencing/next-generation-Product
FAQ
What is CVE-2025-54303?
CVE-2025-54303 is a vulnerability with a CVSS score of 9.8 (CRITICAL). The Thermo Fisher Torrent Suite Django application 5.18.1 has weak default credentials, which are stored as fixtures for the Django ORM API. The ionadmin user account can be used to authenticate to de...
How severe is CVE-2025-54303?
CVE-2025-54303 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2025-54303?
Check the references section above for vendor advisories and patch information. Affected products include: Thermofisher Torrent Suite Software.