Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2025-54808Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials

Description

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory (/tmp) on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the token is leaked (e.g., via malware infection or other local exploit), and remote access is enabled, it can be used to establish unauthorized remote connections to the sequencer. Remote access must be enabled for remote exploitation to succeed. This may occur either because the user has enabled remote access for legitimate operational reasons or because malware with elevated privileges (e.g., sudo access) enables it without user consent. This vulnerability can be chained with remote access capabilities to generate a developer token from a remote device. Developer tokens can be created with arbitrary expiration dates, enabling persistent access to the sequencer and bypassing standard authentication mechanisms.

Timeline

  1. ID reserved

    By icscert

  2. · 30 days later

    Published

  3. · 7 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2025-54808, by who scored it
Scored byCVSSScoreVector
icscertCNA (assigner)4.0High7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
icscertCNA (assigner)3.1High7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVDNVD · Deferred4.0High7.3CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.16% · top 94% of all CVEs (13 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.3.

Affected products

What to do

Solution: Oxford Nanopore Technologies recommends users upgrade to MinKNOW Versions later than 24.11 https://nanoporetech.com/software/  to eliminate these vulnerabilities. If users are unable to upgrade to v24.11 to reduce risk from the remaining Authentication Token and Token Lock vulnerabilities, Oxford Nanopore advises the following additional measures for users on version 24.06: * Remote Connect: Keep Remote Connect disabled in MinKNOW unless strictly required, and enable it only within trusted network environments. * Endpoint Protection: Install and maintain antivirus and malware scanning tools to mitigate denial-of-service (DoS) conditions arising from local exploitation or malware. Users running older versions of MinKNOW who cannot upgrade immediately should contact Oxford Nanopore Support https://nanoporetech.com/about/contact  for guidance on securing their configurations. Downloading the release requires users to be logged into the Nanopore Community.

References

References4

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2025-54808 badge
[![CVE-2025-54808](https://cveledger.app/badge/CVE-2025-54808.svg)](https://cveledger.app/cve/CVE-2025-54808)

Record last updated .