CVE-2018-1000049

Published: Feb 9, 2018Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 1.6 / Impact: 5.9

Source: NVD

Description

Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing the miner API. The flaw can be exploited only if the software is executed with read/write mode enabled.

Affected (1)

Products: Nanopool: Claymore Dual Miner

Nanopool

1 product

Claymore Dual Miner

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Nanopool Claymore Dual Miner	Up to 7.3

Related CWEs

CWE-20

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (18)

http://packetstormsecurity.com/files/147678/Nanopool-Claymore-Dual-Miner-7.3-Remote-Code-Execution.html

Source: cve@mitre.org

http://packetstormsecurity.com/files/148578/Nanopool-Claymore-Dual-Miner-APIs-Remote-Code-Execution.html

Source: cve@mitre.org

http://www.rapid7.com/db/modules/exploit/multi/misc/claymore_dual_miner_remote_manager_rce

Source: cve@mitre.org

https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2018/1000xxx/CVE-2018-1000049.json

Source: cve@mitre.org

https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution

Source: cve@mitre.org

https://reversebrain.github.io/2018/02/01/Claymore-Dual-Miner-Remote-Code-Execution/

Source: cve@mitre.org

ExploitThird Party Advisory

https://twitter.com/ReverseBrain/status/951850534985662464

Source: cve@mitre.org

Third Party Advisory

https://www.exploit-db.com/exploits/44638/

Source: cve@mitre.org

https://www.exploit-db.com/exploits/45044/

Source: cve@mitre.org

http://packetstormsecurity.com/files/147678/Nanopool-Claymore-Dual-Miner-7.3-Remote-Code-Execution.html