CVE-2022-36604

HIGH

Canaan Avalon ASIC Miner <2020.3.30 - Info Disclosure

Title source: llm
STIX 2.1

Description

An access control issue in Canaan Avalon ASIC Miner 2020.3.30 and below allows unauthenticated attackers to arbitrarily change user passwords via a crafted POST request.

References (1)

Core 1
Core References

Scores

CVSS v3 7.5
EPSS 0.0063
EPSS Percentile 45.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

CWE
CWE-306
Status published
Products (1)
canaan/avalon_asic_miner_firmware < 2020.3.30
Published Sep 01, 2022
Tracked Since Feb 18, 2026