Vulnerability · Published Oct 23, 2025 · Assigned by icscert
CVE-2025-10937Oxford Nanopore Technologies MinKNOW Improper Check for Unusual or Exceptional Conditions
Medium 5.5
In plain English
A medium-severity security flaw in MinKNOW from Oxford Nano Technologies. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 5% of all known vulnerabilities).
Official description
Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 creates a temporary file to store the local authentication token during startup, before copying it to its final location. This temporary file is created in a directory accessible to all users on the system. An unauthorized local user or process can exploit this behavior by placing a file lock on the temporary token file using the flock system call. This prevents MinKNOW from completing the token generation process. As a result, no valid local token is created, and the software is unable to execute commands on the sequencer. This leads to a denial-of-service (DoS) condition, blocking sequencing operations.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Oxford Nano Technologies | MinKNOW | 0 – before 24.11 |
Weakness: CWE-754 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H