PT-2025-9235 · Bitaxe · Bitaxe Esp-Miner

Shaunography · Published 2025-03-02 · Updated 2025-03-04 · CVE-2025-27579

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Bitaxe ESP-Miner versions prior to 2.5.0

Description The issue allows an attacker to perform a CSRF attack via the "/api/system" API endpoint to update the payout address, also known as stratumUser, for a Bitaxe Bitcoin miner. Additionally, it enables changes to the frequency and voltage settings.

Recommendations For versions prior to 2.5.0, update to version 2.5.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the "/api/system" API endpoint to minimize the risk of exploitation.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2025-27579

Affected Products

Bitaxe Esp-Miner

References · 9

• 🔥 https://snotra.uk/axeos-csrf-vulnerability.html · Exploit
• https://osv.dev/vulnerability/CVE-2025-27579 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27579 · Security Note
• https://github.com/skot/ESP-Miner/pull/637 · Note
• https://nobsbitcoin.com/bitaxe-firmware-esp-miner-v2-5-0 · Note
• https://t.me/cvenotify/113424 · Telegram Post
• https://t.me/cvedetector/19286 · Telegram Post
• https://twitter.com/CVEnew/status/1896399771394306061 · Twitter Post
• https://t.me/cvenotify/113028 · Telegram Post