MinKNOW is the control software for Oxford Nanopore DNA and RNA sequencers. ICSMA-25-294-01 says versions before 24.06 and 24.11 shipped with CVE-2024-35585, missing authentication for a critical function, base score 8.6. Two more come with it: insufficiently protected credentials at 7.8, and an improper check for exceptional conditions. Together they let an attacker disrupt sequencing runs, exfiltrate or alter data, and bypass authentication.
A University of Florida team, Sara Rampazzi, Christina Boucher, Carson Stillman and Jonathan Bravo, reported it. Sequencers are drifting from the research bench into clinical and public-health workflows, which changes what a manipulated result costs.
Update MinKNOW. And note the pattern: research-grade instruments were built when the threat model was a curious grad student, not a network adversary. That assumption expires the moment the box gets an IP address.