Oxford Nano MinKNOW up to 24.10 /tmp insufficiently protected credentials

Summaryinfo

A vulnerability identified as critical has been detected in Oxford Nano MinKNOW up to 24.10. The affected element is an unknown function of the file /tmp. Performing a manipulation results in insufficiently protected credentials. This vulnerability is cataloged as CVE-2025-54808. The attack must be initiated from a local position. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, was found in Oxford Nano MinKNOW up to 24.10. This affects some unknown functionality of the file /tmp. The manipulation with an unknown input leads to a insufficiently protected credentials vulnerability. CWE is classifying the issue as CWE-522. The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (/tmp) on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the token is leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish unauthorized remote connections to the sequencer. Remote access must be enabled for remote exploitation to succeed. This may occur either because the user has enabled remote access for legitimate operational reasons or because malware with elevated privileges (e.g., sudo access) enables it without user consent. This vulnerability can be chained with remote access capabilities to generate a developer token from a remote device. Developer tokens can be created with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication mechanisms.

The weakness was shared by Sara Rampazzi, Christina Boucher, Carson Stillman and Jonathan E. Bravo as icsma-25-294-01. The advisory is shared at cisa.gov. This vulnerability is uniquely identified as CVE-2025-54808 since 09/23/2025. The exploitability is told to be easy. An attack has to be approached locally. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Upgrading to version 24.11 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Medical Device Software

Vendor

• Oxford Nano

Name

• MinKNOW

Version

• 24.0
• 24.1
• 24.2
• 24.3
• 24.4
• 24.5
• 24.6
• 24.7
• 24.8
• 24.9
• 24.10

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion