CVE-2022-40769

HIGH EXPLOITED

profanity < 1.60 - Use of Cryptographically Weak PRNG

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-40769 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 2 public exploits from researchers including PLSRcoin, ethicbrudhack.

AI-analyzed exploit summary This repository documents CVE-2022-40769, a vulnerability in the Profanity tool (up to v1.60) where weak RNG initialization allows attackers to recover private keys from Ethereum vanity addresses. It includes references and a data file but no functional exploit code.

Description

profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022.

Exploits (2)

nomisec WRITEUP 1 stars
by PLSRcoin · poc
https://github.com/PLSRcoin/CVE-2022-40769

This repository documents CVE-2022-40769, a vulnerability in the Profanity tool (up to v1.60) where weak RNG initialization allows attackers to recover private keys from Ethereum vanity addresses. It includes references and a data file but no functional exploit code.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: Profanity (Ethereum vanity address tool) <= 1.60
No auth needed
Prerequisites: Access to a vanity address generated by Profanity
mistral-large-3 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by ethicbrudhack · poc
https://github.com/ethicbrudhack/CVE-2022-40769---Profanity

This repository contains a functional key generator for CVE-2022-40769 (Profanity) and CVE-2023-39910 (Libbitcoin), which exploits weak RNG implementations to generate private keys. The code demonstrates the vulnerabilities by generating keys using the flawed algorithms (LCG for Profanity and mt19937 for Libbitcoin).

Classification
Working Poc 95%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Reliable
Target: Profanity (Ethereum vanity address generator), libbitcoin-explorer 3.2.0
No auth needed
Prerequisites: knowledge of seed range to generate keys
mistral-large-3 · analyzed Jun 23, 2026 Full analysis →

References (3)

Core 3
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/johguse/profanity/issues/61

Scores

CVSS v3 7.5
EPSS 0.0110
EPSS Percentile 62.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2022-09-18
CWE
CWE-338
Status published
Products (1)
profanity_project/profanity < 1.60
Published Sep 18, 2022
Tracked Since Feb 18, 2026