PT-2022-16779 · Goldshell · Goldshell Asic Miners

James A. Chambers · Published 2022-07-20 · Updated 2022-07-27 · CVE-2022-24657

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Goldshell ASIC Miners versions 2.1.x

Description The issue concerns hardcoded credentials in the software, allowing attackers to remotely connect via the SSH protocol on port 22.

Recommendations For Goldshell ASIC Miners versions 2.1.x, consider changing the default credentials and restricting access to the SSH protocol as a temporary mitigation measure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2022-24657

Affected Products

Goldshell Asic Miners

References · 5

• 🔥 https://jamesachambers.com/cryptocurrency-asic-miners-security-and-hacking-audit · Exploit
• https://osv.dev/vulnerability/CVE-2022-24657 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24657 · Security Note
• https://github.com/goldshellminer/firmware · Note
• https://t.me/cibsecurity/46648 · Telegram Post