MinKNOW software versions at or prior to 24.11 store authentication tokens in the system's /tmp directory, which is typically world-readable. This insecure storage allows local users or applications to access these tokens. If remote access is enabled, an attacker with access to the token can remotely connect to the sequencer. The vulnerability can be chained to generate developer tokens with arbitrary expiration dates, allowing persistent access and bypassing normal authentication. Exploitation requires local access to the host system and remote access enabled on the sequencer. The vulnerability is identified as CWE-522 and has a CVSS 4.0 score of 7.3, indicating high severity. There is no information about an available patch or vendor advisory specifying remediation.

Unauthorized local users or applications can access authentication tokens stored insecurely in a world-readable temporary directory. If remote access is enabled, these tokens can be used to establish unauthorized remote connections to the sequencer. Attackers can generate developer tokens with arbitrary expiration dates, enabling persistent unauthorized access and bypassing standard authentication controls. This could lead to compromise of the sequencer's operation and data integrity. Exploitation requires local access and remote access enabled, limiting the attack vector to environments where these conditions are met.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict local access to the host system to trusted users only and disable remote access on the sequencer if not required. Monitor for unauthorized enabling of remote access and consider securing the /tmp directory or the token storage mechanism to prevent unauthorized local access. Follow any updates from Oxford Nanopore Technologies regarding patches or configuration changes.