PT-2022-11331 · Unknown · Antminer Monitor

Published 2022-06-17 · Updated 2023-08-08 · CVE-2021-40903

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Antminer Monitor version 0.50.0

Description A vulnerability exists in the Antminer Monitor due to a backdoor or misconfiguration inside a settings file in the flask server. The settings file contains a predefined secret string that is static, although it should be randomly generated.

Recommendations For Antminer Monitor version 0.50.0, consider regenerating the secret string to a random value to mitigate the risk of exploitation. As a temporary workaround, restrict access to the settings file in the flask server until a proper fix is applied.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2021-40903

Affected Products

Antminer Monitor

References · 8

• 🔥 https://exploit-db.com/exploits/50267 · Exploit
• 🔥 https://packetstormsecurity.com/files/164048/Antminer-Monitor-0.5.0-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-40903 · Security Note
• https://osv.dev/vulnerability/CVE-2021-40903 · Vendor Advisory
• https://github.com/anselal/antminer-monitor · Note
• https://t.me/cvenotify/31854 · Telegram Post
• https://t.me/cvenotify/32290 · Telegram Post
• https://t.me/cibsecurity/44741 · Telegram Post