CVE-2025-10937: Oxford Nanopore Technologies MinKNOW Improper Check for Unusual or Exceptional Conditions

Published Oct 23, 2025
·
Updated

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.

Affected Software

1 affected component
Oxford Nanopore Technologies MinKNOW<=24.11

Remediation

Information

Oxford Nanopore Technologies recommends users upgrade to MinKNOW Versions later than 24.11 https://nanoporetech.com/software/  to eliminate these vulnerabilities. If users are unable to upgrade to v24.11 to reduce risk from the remaining Authentication Token and Token Lock vulnerabilities, Oxford Nanopore advises the following additional measures for users on version 24.06: * Remote Connect: Keep Remote Connect disabled in MinKNOW unless strictly required, and enable it only within trusted network environments. * Endpoint Protection: Install and maintain antivirus and malware scanning tools to mitigate denial-of-service (DoS) conditions arising from local exploitation or malware. Users running older versions of MinKNOW who cannot upgrade immediately should contact Oxford Nanopore Support https://nanoporetech.com/about/contact  for guidance on securing their configurations. Downloading the release requires users to be logged into the Nanopore Community.

Event History

Oct 23, 2025
CVE Published
via MITRE·06:24 PM
Data Sourced
via MITRE·06:24 PM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·07:15 PM
DescriptionSeverityWeakness

Frequently Asked Questions

1

What is the severity of CVE-2025-10937?

CVE-2025-10937 is classified as a medium-severity vulnerability due to its potential impact on user authentication security.

2

How do I fix CVE-2025-10937?

To fix CVE-2025-10937, update the MinKNOW software to a version newer than 24.11 where the issue has been addressed.

3

What systems are affected by CVE-2025-10937?

CVE-2025-10937 affects Oxford Nanopore Technologies' MinKNOW software versions 24.11 and earlier.

4

What is the nature of the vulnerability in CVE-2025-10937?

CVE-2025-10937 involves improper handling of a temporary file that stores a local authentication token, which could be accessed by unauthorized users.

5

Can CVE-2025-10937 lead to unauthorized access?

Yes, if exploited, CVE-2025-10937 can potentially allow unauthorized access to sensitive user authentication information.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203