PT-2025-43538 · Oxford Nano Technologies · Minknow

Published 2025-10-23 · Updated 2025-10-23 · CVE-2025-10937

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11

Description The MinKNOW software creates a temporary file to store the local authentication token during startup, before moving it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process, resulting in no valid local token being created. Consequently, the software cannot execute commands on the sequencer, leading to a denial-of-service (DoS) condition that blocks sequencing operations.

Recommendations Update MinKNOW to version 24.11 or later.

Fix

DoS

Improper Check for Exceptional Conditions

Weakness Enumeration

CWE-754

Related Identifiers

CVE-2025-10937

Affected Products

Minknow

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-10937 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json · Note
• https://twitter.com/CVEnew/status/1981432873769984412 · Twitter Post
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-294-01 · Note
• https://nanoporetech.com/software · Note
• https://twitter.com/VulmonFeeds/status/1981476715655241859 · Twitter Post
• https://nanoporetech.com/about/contact · Note
• https://t.me/CVEtracker/35593 · Telegram Post