CVE-2017-16930

published 2017-12-05

CVE-2017-16930: The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based…

Priority P1 78 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
claymore_dual_miner_project	claymore_dual_miner	—	—

Detection & IOCs extracted from sources · hover to see the quote

port 3333↗

process EthDcrMiner64.exe↗

command {"id":1,"jsonrpc":"2.0","method":"miner_getstat1 " + "a" * (16384 - 50 - 15 - 5)}↗

command {"id":1,"jsonrpc":"2.0","lol":"a"*145000}↗

command {"id":1,"psw":"d"*145000}↗

• → Detect oversized JSON API requests to port 3333 targeting the Claymore miner remote management interface; a payload with a 'method' field value exceeding ~16 KB (e.g., 16384 bytes) triggers the stack-based buffer overflow during logging. ↗

• · The remote management port is configurable via the -mport flag; while 3333 is the default, defenders should scan for the miner process listening on other ports as well. ↗
• · The 'traversal' (path traversal) vector requires authentication, but the buffer overflow vectors ('method', 'extrafield', 'psw') do NOT require authentication and work even in read-only mode. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 10.0 CRITICAL AV:N/AC:L/Au:N/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-119