PT-2025-43541 · Oxford Nano Technologies · Minknow

Published 2025-10-23 · Updated 2025-10-28 · CVE-2025-54808

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Oxford Nanopore Technologies MinKNOW versions prior to 24.11

Description The MinKNOW software stores authentication tokens in a world-readable file within the system's temporary directory (/tmp) on the host machine. If a token is compromised, and remote access is enabled, unauthorized remote connections to the sequencer can be established. The vulnerability can be chained with remote access capabilities to generate a developer token with an arbitrary expiration date, enabling persistent access and bypassing standard authentication. Remote access must be enabled for remote exploitation to succeed.

Recommendations Versions prior to 24.11 should be updated.

Fix

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2025-54808

Affected Products

Minknow

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-54808 · Security Note
• https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json · Note
• https://twitter.com/cracbot/status/1983126659189620897 · Twitter Post
• https://nanoporetech.com/software · Note
• https://nanoporetech.com/about/contact · Note
• https://cisa.gov/news-events/ics-medical-advisories/icsma-25-294-01 · Note
• https://t.me/CVEtracker/35591 · Telegram Post
• https://twitter.com/CVEnew/status/1981432875829346697 · Twitter Post