PT-2024-10725 · Easymine · Easymine

Published 2024-04-30 · Updated 2024-07-03 · CVE-2019-19751

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions easyMINE versions prior to 2019-12-05

Description The issue allows man-in-the-middle attacks due to SSH host keys being baked into the installation image. This makes it trivial to identify all public IPv4 nodes using Shodan.io.

Recommendations For easyMINE versions prior to 2019-12-05, consider regenerating SSH host keys to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the affected nodes to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-300

Related Identifiers

CVE-2019-19751

Affected Products

Easymine

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-19751 · Security Note
• https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html · Note
• https://blog.easymine.io · Note
• https://twitter.com/CVEnew/status/1785366626071609480 · Twitter Post
• https://t.me/cvenotify/78606 · Telegram Post