PT-2024-10726 · Nvoc · Nvoc

Published 2024-04-30 · Updated 2025-03-25 · CVE-2019-19752

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions nvOC versions 3.2 and earlier

Description The issue allows man-in-the-middle attacks due to SSH host keys being baked into the installation image. This also makes it trivial to identify all public IPv4 nodes using Shodan.io. The vendor has indicated plans to fix this issue in the next image build as of 2019-12-01.

Recommendations For nvOC versions 3.2 and earlier, consider regenerating SSH host keys to prevent man-in-the-middle attacks. As a temporary workaround, restrict access to the affected nodes to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-321

Related Identifiers

CVE-2019-19752

Affected Products

Nvoc

References · 7

• https://osv.dev/vulnerability/CVE-2019-19752 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-19752 · Security Note
• https://github.com/papampi/nvOC_by_fullzero_Community_Release/commits/release · Note
• https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html · Note
• https://t.me/cvenotify/116215 · Telegram Post
• https://t.me/cvenotify/78607 · Telegram Post
• https://twitter.com/CVEnew/status/1785366627166404770 · Twitter Post