CVE-2018-6317 : The remote management interface in Claymore Dual Miner 10.5 and earlier is vulne

The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service.

Published 2018-02-02 21:29:01

Updated 2018-02-15 15:14:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2018-6317

Claymore Dual Miner Project » Claymore Dual Miner
Versions up to, including, (<=) 10.5
cpe:2.3:a:claymore_dual_miner_project:claymore_dual_miner:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-6317

EPSS FAQ

17.59%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2018-6317

Claymore Dual GPU Miner Format String dos attack

Disclosure Date: 2018-02-06

First seen: 2020-04-26

auxiliary/dos/tcp/claymore_dos

Claymore’s Dual GPU Miner 10.5 and below is vulnerable to a format strings vulnerability. This allows an unauthenticated attacker to read memory addresses, or immediately terminate the mining process causing a denial of service. Authors: - res1n - bluebird

More information

CVSS scores for CVE-2018-6317

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
6.4	MEDIUM	AV:N/AC:L/Au:N/C:P/I:N/A:P	10.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: Partial
9.1	CRITICAL	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H	3.9	5.2	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: High

CWE ids for CVE-2018-6317

CWE-134 Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-6317

https://www.exploit-db.com/exploits/43972/

Claymore Dual GPU Miner 10.5 - Format String
Exploit;Third Party Advisory;VDB Entry
https://medium.com/@res1n/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30

Cryptominer Disclosure: Claymore Dual Gpu Miner Format Strings Vulnerability
Exploit;Third Party Advisory

Jump to