MinKNOW CVE-2025-10937
MEDIUMAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain local account on sequencer host
-
Exploitflock() the shared temp token file at startup
-
ExecutionMinKNOW token generation blocked
-
ImpactSequencing operations denied (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A10:2025 - Mishandling of Exceptional Conditions
ASVS 5.0
V16 - Security Logging and Error Handling Unusual condition handling
|
| Exploitation Conditions | Requires an unprivileged local account or process on the host running MinKNOW at or prior to version 24.11, because the software writes the local authentication token to a temporary file in a directory accessible to all users before relocating it. The attacker must hold an flock() lock on that temporary file during MinKNOW's startup/token-generation window to block completion. Limiting factors: exploitation is purely local (no network vector), needs a low-privilege foothold (PR:L), depends on timing against the startup sequence, and is confined to affected versions (≤24.11); impact is availability-only (sequencing DoS) with no data exposure or code execution. |
| Impact | This is a genuinely low-priority issue despite a medium 6.8 CVSS 4.0 score. The vector (AV:L/AC:L/AT:N/PR:L/UI:N) confirms a locally-exploitable, availability-only flaw: an authenticated local user can disrupt MinKNOW token generation, but there is no confidentiality or integrity impact (VC:N/VI:N) and no scope change (SC:N/SI:N/SA:N). Supporting signals all point the same direction: EPSS is 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit was identified. SSVC-style reasoning agrees - exploitation requires local presence, the technical impact is partial (DoS only), and it is not realistically automatable at scale against remote targets. The one notable data conflict is the input Tag 'Authentication Bypass,' which does not match the described behavior (CWE-754, a file-locking DoS that PREVENTS a valid token from being created) - this is not an authentication bypass and should be treated as a mislabel. Overall: a real but low-urgency, locally-scoped availability bug affecting a niche instrument-control product, not a widespread remote-exploitation emergency. |
| Exploit ScenarioDerived | A low-privileged user (or rogue process) already present on a sequencing workstation watches for MinKNOW startup and places an flock() lock on the world-accessible temporary token file before MinKNOW copies it to its final location. Token generation stalls, no valid local token is produced, and the sequencer can no longer accept commands - halting lab sequencing runs. No public exploit code was identified, but the technique is trivially reproducible given local access (AV:L/AC:L). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 08, 2026
A local denial-of-service condition affects Oxford Nanopore Technologies' MinKNOW sequencing control software at version 24.11 and earlier, where the startup routine writes the local authentication token to a temporary file inside a directory that is readable and writable by all users on the host before relocating it to its final location. An attacker holding a low-privileged local account or running an unprivileged local process can call flock() on that temporary file to block MinKNOW from finishing token generation, leaving the instrument without a valid local token so that it cannot execute sequencing commands; the result is an availability-only outage (no confidentiality or integrity impact, no code execution). There is no public exploit identified at time of analysis, and EPSS is very low at 0.16% (4th percentile), so this is best treated as a low-priority, locally-scoped nuisance/availability bug rather than a broadly exploitable threat.
RemediationAI
No vendor-released patch version is identified in the available data, so the primary action is to confirm the current fixed release on the vendor's software page (https://nanoporetech.com/software/) and the CISA advisory ICSMA-25-294-01 (https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-294-01), then upgrade MinKNOW past 24.11 as soon as an advisory-confirmed build is available; contact the vendor via https://nanoporetech.com/about/contact if the fixed version for your instrument platform is unclear. Because no patch is confirmed, compensating controls matter: restrict interactive and local logon on MinKNOW hosts to a small set of trusted instrument operators and eliminate shared or guest accounts, since exploitation requires only a low-privileged local principal (trade-off: this reduces flexibility for multi-user lab workflows and requires account hygiene); consider confining MinKNOW with SELinux/AppArmor policy or, on systemd-managed hosts, a private temporary directory (PrivateTmp=yes) so its token file lands in a namespace other users cannot reach (trade-off: these controls can break instrument integration, hardware access, or vendor support, so validate on a non-production sequencer first); and monitor or alert on processes holding flock() locks in shared temporary directories during MinKNOW startup, plus configure the service to restart with retry on token-generation failure so an interrupted lock window self-heals. Do not rely on the low EPSS (0.16%) or the absence of public exploit code to deprioritize this entirely on multi-user lab machines, but note that the impact is availability-only and cannot be leveraged for credential theft or code execution.
Affected ProductsAI
Oxford Nanopore Technologies MinKNOW sequencing control software, versions at or prior to 24.11, on hosts where the software is installed (the advisory covers the local installation used to drive Nanopore sequencers). No CPE strings were supplied in the available intelligence, so affected-asset enumeration should be driven by the vendor's software listing at https://nanoporetech.com/software/ rather than by a CPE match. The authoritative source is CISA ICS Medical Advisory ICSMA-25-294-01, published at https://www.cisa.gov/news-events/ics-medical-advisories/icsma-25-294-01 (mirrored as the CSAF document https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2025/icsma-25-294-01.json); vendor contact and coordination details are at https://nanoporetech.com/about/contact. Organizations running MinKNOW 24.11 or earlier should inventory every host and instrument workstation where it is installed, since the vulnerability is exposed to any account that can log on locally to that machine.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MinKNOW is the instrument-control and run-management software for Oxford Nanopore sequencers, and it relies on a locally stored authentication token so that the on-instrument or host-side client can issue commands to the sequencing hardware. The root cause falls under CWE-754 (Improper Check for Unusual or Exceptional Conditions): during startup the token is first materialized as a temporary file in a shared, all-users-accessible directory (the class of problem typified by world-writable /tmp-style paths) and only afterwards copied to its protected final path. Because the intermediate file lives in a shared namespace and its creation/move sequence does not defend against adverse file state, another process can seize a POSIX advisory lock (flock()) on that path, causing the token-writing step to fail or time out and denied the software its credential. The vendor advisory (CISA ICS Medical Advisory ICSMA-25-294-01) is tagged "Authentication Bypass" and reported by ics-cert@hq.dhs.gov, but the assessed CVSS:4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N) and the independent CVSS:3.1 assessment (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) both confirm that no credentials are actually obtained or bypassed in a way that grants access: the observable effect is purely loss of availability, since blocking token creation stops MinKNOW from executing commands on the sequencer. The lock-based mechanism means exploitation depends on winning a timing window during startup, requires a pre-existing low-privilege foothold on the host, and has no network vector; properly hardened designs would use O_EXCL/mkstemp in a mode-0700 per-service directory (or an in-memory credential) with retry logic and no predictable, writable intermediate path.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Local low-privilege user races a startup file lock (AV:L/PR:L/AC:L); no UI needed, availability-only DoS so A:H with C:N/I:N and scope unchanged.
Primary rating from Vendor (hq).
CVSS VectorVendor: hq
DescriptionCVE.org
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
Exploit-DB