CVE-2018-6317

EPSS 43.7%

Vexday Risk Score

50Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 43.7%KEV nãoPoC públicaNuclei —Metasploit simPatch —

Lifecycle

02 Feb 2018Published on NVD

05 Feb 2018Public PoC

06 Feb 2018Metasploit module available

Weaponization speed

2 daysto first PoC

3 daysto Metasploit module

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated format string vulnerability, allowing remote attackers to read memory or cause a denial of service.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/43972/unverified exploitdbwww.exploit-db.com/exploits/43972unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://medium.com/%40res1n/claymore-dual-gpu-miner-10-5-format-strings-vulnerability-916ab3d2db30 https://www.exploit-db.com/exploits/43972/