MinKNOW CVE-2025-54808

Exploitation requires three concrete, stacked prerequisites drawn directly from the description: (1) local presence on the MinKNOW host to read the authentication token from the world-readable system temporary directory (/tmp) - AV:L; (2) a valid token actually written to /tmp by a running MinKNOW session; and (3) remote access explicitly ENABLED on the sequencer, which is the key limiting factor (AT:P) and occurs only when an operator turns it on for legitimate use or when separate malware with elevated/sudo privileges enables it without consent. Default configurations without remote access enabled are not remotely exploitable. These conditions make the flaw a post-compromise persistence/lateral-movement amplifier rather than a remote unauthenticated entry point; the PR:L metric reflects that some local foothold is needed.

This is a genuine but conditional, non-urgent issue rather than a drop-everything priority. The CVSS 4.0 vector (AV:L/AC:L/AT:P/PR:L/UI:N) and score of 7.3 correctly reflect a LOCAL attack vector with a Present attack requirement (AT:P) - exploitation hinges on remote access being enabled on the sequencer, which the vendor states is not the default operational mode. All three impact metrics are High (VC:H/VI:H/VA:H), justified because a leaked developer token with an arbitrary expiration grants persistent, authentication-bypassing control of the sequencer. The signals are internally consistent and point to LOW real-world probability: EPSS is 0.16% (4th percentile), there is no CISA KEV listing, and no public exploit code is referenced. CWE-522 (insufficiently protected credentials) matches the described world-readable /tmp token storage. Note the layered dependency chain - an attacker needs (a) local read access to /tmp, (b) the token to be present, and (c) remote access already enabled (by an operator or by separate malware with sudo) - so this is realistically a post-compromise privilege/persistence amplifier, not an initial-access vulnerability. No conflicting data was found, but the absence of any vendor-published fixed version in the references means remediation status could not be confirmed from the input.

A local user or malware already present on the MinKNOW host reads the authentication token from the world-readable /tmp directory. If remote access has been enabled (either intentionally by an operator or by privileged malware), the attacker replays the token to establish an unauthorized remote connection to the sequencer and then mints a developer token with a far-future expiration for durable access. No public exploit code is identified at time of analysis.