CVE-2024-35585 Details

A vulnerability exists in Oxford Nanopore MinKNOW versions prior to 24.06, where authentication relies on the client's source IP address. This flaw allows unauthorized users on the same network to access the sequencer by registering a legitimate or temporary Oxford Nanopore account. Once connected through the MinKNOW application, these users can observe sequencing activity, pause or stop data collection, and redirect output data to another location. Additionally, the software stores authentication tokens in a temporary directory that is typically world-readable, creating another avenue for unauthorized access if the token is leaked.

Users are advised to upgrade to MinKNOW versions later than 24.11. For those on version 24.06 who cannot upgrade immediately, Oxford Nanopore recommends keeping Remote Connect disabled unless strictly necessary, and maintaining antivirus and malware scanning tools. Users should contact Oxford Nanopore Support for guidance on securing their configurations if they are unable to upgrade.