CVE-2022-24660

No known exploitation. EPSS puts it in the 50th percentile. Only a workaround so far.

CVSS 3.17.5High EPSS percentile50th0.6% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixWorkaroundNo fixed build yet

Published 2022-07-20Updated 2024-11-21Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build is published yet. The vendor describes a workaround.

Goldshell Miner FirmwareAffected: ≤ 2.2.1Upgrade to: after 2.2.1Stated by: NVD

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check each Goldshell miner’s firmware version and whether its web management page is reachable from the internet.
Remove public access to the miner management page; limit it to trusted internal devices or a secured remote-access connection.
No fixed firmware version is currently available; check Goldshell’s official support channel for an update that addresses CVE-2022-24660.
Change passwords that were used on affected miners, especially any password reused elsewhere.
Review miner and network access records for unfamiliar logins or configuration changes.

May need vendor or contractor work

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

The debug interface of Goldshell ASIC Miners v2.2.1 and below was discovered to be exposed publicly on the web interface, allowing attackers to access passwords and other sensitive information in plaintext.

In plain language

Written by AI from the record

Goldshell miner firmware v2.2.1 and below can expose passwords through its web controls, so affected miners should be isolated and reviewed soon.

Goldshell miner firmware v2.2.1 and below exposes a publicly accessible debug interface that can disclose plaintext credentials and other sensitive information.

If you're affected

Miner account password exposure
Unauthorized miner access
Mining revenue disruption
Network pivot risk

What is it

This is a flaw in the web controls used to manage certain Goldshell mining devices. It is like leaving a maintenance notebook in a publicly accessible utility room: someone who reaches it may be able to read passwords and other private details.

Who is affected

This matters to you if you run Goldshell miner firmware v2.2.1 or below on mining hardware. It is most relevant when the device’s web management page can be reached from the internet.

How urgent is it

There is no confirmed report that attackers are actively exploiting this issue, and it is not on CISA’s known-exploited list. Treat this as an amber issue: promptly remove internet exposure and rotate credentials, particularly for miners in production.

What to do — in detail

Confirm exposure by inventorying Goldshell miners running firmware v2.2.1 or below and testing, from an approved external network, whether their management interfaces are publicly reachable. No corrected firmware version or supported upgrade path is available in the findings, so do not assume an update resolves CVE-2022-24660.

Until Goldshell provides a fix, place miner management interfaces behind a firewall or management network, allow access only from trusted administrator devices, and use secured remote access rather than public web access. Change miner passwords and any reused credentials, then review device settings, administrator access, and network logs for unexpected changes or connections. CISA has not assigned a KEV remediation due date because this CVE is not listed in KEV.

Technical context

CVE-2022-24660 has CVSS 7.5 (High): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The reported weakness is CWE-312, Cleartext Storage of Sensitive Information: Goldshell miner firmware v2.2.1 and below exposes a debug interface through the web interface, permitting disclosure of plaintext passwords and other sensitive information. The attack vector is network-based, with no privileges or user interaction indicated by the CVSS vector. It is not listed in CISA KEV, no public exploit code is on record, and EPSS predicts 0.6% likelihood with a flat trend. Press attention is rising, but that is not evidence of exploitation.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS50th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.6% chance of exploitation activity in the next 30 days, which ranks it in the 50th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

5 events over 855 days, from the signal feeds we watch.

2024-11-21Workaround availablerecord updated
2022-07-20Publishedweakness classified, att&ck mapped

Affected products

goldshellcommercialaka goldshell miner firmware
- goldshell miner firmwareEmbeddedHardware Firmware / cpu-gpu

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Scored 7.5 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity NoneNo integrity impact
Availability NoneNo availability impact