CVE-2024-35585: CWE-306 Missing Authentication for Critical Function in Oxford Nanopore MinKNOW

Oxford Nanopore MinKNOW versions prior to 24.06 implement authentication for critical functions based only on the client's source IP address. This approach is classified under CWE-306 (Missing Authentication for Critical Function), as it does not adequately verify the identity of the client, potentially allowing unauthorized access. The vulnerability is remotely exploitable without privileges or user interaction, with high impact on confidentiality, low impact on integrity, and low impact on availability as per CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L. No vendor advisory or patch information is currently available.

The vulnerability allows remote attackers to bypass proper authentication controls by exploiting the reliance on source IP address for authentication. This can lead to unauthorized access to critical functions, resulting in high confidentiality impact, low integrity impact, and low availability impact. The lack of proper authentication increases the risk of sensitive data exposure or unauthorized operations within the affected MinKNOW software.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting network access to trusted clients and monitoring for unauthorized access attempts. Avoid relying solely on IP-based authentication for critical functions.