CVE-2024-35585: Oxford Nanopore MinKNOW Auth Bypass Flaw

CVE-2024-35585 Overview

CVE-2024-35585 affects Oxford Nanopore MinKNOW versions before 24.06. The software relies on a client's source IP address as its authentication mechanism. Attackers on the network can bypass authentication by spoofing or originating requests from a trusted IP address. The flaw is categorized under CWE-306: Missing Authentication for Critical Function. MinKNOW controls Oxford Nanopore DNA and RNA sequencing devices used in research and clinical laboratories. CISA published a medical device advisory tracking this issue as ICSMA-25-294-01.

Critical Impact
Network-adjacent attackers can bypass authentication by using a trusted source IP, gaining unauthorized access to sequencing device control and data.

Affected Products

Oxford Nanopore MinKNOW versions prior to 24.06
Sequencing workstations running vulnerable MinKNOW builds
Laboratory networks hosting MinKNOW-controlled Nanopore devices

Discovery Timeline

2026-09-02 - CVE-2024-35585 published to NVD
2026-09-02 - Last updated in NVD database

Technical Details for CVE-2024-35585

Vulnerability Analysis

MinKNOW exposes a network-accessible control interface for Oxford Nanopore sequencing hardware. The service authenticates clients by inspecting the source IP address of incoming connections. Any client whose packets appear to originate from an allow-listed address is granted access to protected functions. IP-based authentication provides no cryptographic proof of identity and can be defeated by anyone who controls a trusted host or a network path to it.

Successful exploitation grants an attacker the same level of access as a legitimate operator. That includes reading experimental data, altering sequencing runs, and disrupting device availability. In laboratory and clinical settings this can compromise research integrity and patient sample handling.

Root Cause

The root cause is the use of a client-supplied network attribute, the source IP address, as the sole authentication factor. CWE-306 describes this class of defect: a critical function lacks an authentication check that binds the request to a verified identity. There is no shared secret, token, or certificate validation involved, so trust decisions collapse to network topology.

Attack Vector

Exploitation is remote and requires no privileges or user interaction. An attacker on the same routable network as the MinKNOW host sends control-plane requests from an approved address. Methods include ARP spoofing on the local segment, compromising a workstation already trusted by MinKNOW, or abusing NAT and firewall misconfigurations that make internal IPs reachable. Refer to the CISA Medical Advisory ICSMA-25-294-01 for vendor guidance.

No public proof-of-concept is currently published for this issue.

Detection Methods for CVE-2024-35585

Indicators of Compromise

Connections to MinKNOW service ports from hosts that are not authorized laboratory workstations
Unexpected sequencing runs, protocol changes, or configuration edits recorded in MinKNOW logs
ARP table anomalies or duplicate IP address warnings on segments hosting MinKNOW

Detection Strategies

Inventory MinKNOW installations and confirm running versions against the 24.06 fixed release
Correlate MinKNOW application logs with network flow records to identify sessions from unexpected sources
Alert on any administrative action performed outside defined maintenance windows or operator accounts

Monitoring Recommendations

Enable full session logging on MinKNOW hosts and forward events to a central SIEM
Monitor the laboratory VLAN for ARP spoofing, MAC changes, and rogue DHCP activity
Track outbound connections from sequencing workstations for signs of lateral pivoting

How to Mitigate CVE-2024-35585

Immediate Actions Required

Upgrade Oxford Nanopore MinKNOW to version 24.06 or later on all sequencing hosts
Isolate MinKNOW systems on a dedicated management VLAN with strict ingress filtering
Restrict access to MinKNOW control ports using host firewalls in addition to network ACLs
Review authentication and access logs since the deployment of any affected version

Patch Information

Oxford Nanopore addresses the flaw in MinKNOW 24.06. Operators should apply the vendor-supplied update following the guidance in CISA Medical Advisory ICSMA-25-294-01. Confirm the installed version after upgrade and validate that legitimate laboratory workflows still function.

Workarounds

Place MinKNOW hosts behind a firewall that blocks all inbound traffic except from named laboratory workstations
Disable remote access entirely where local operation is sufficient
Enforce 802.1X or MAC-based port security on switches serving sequencing devices to limit source IP spoofing