CVE-2022-40769

HIGH EXPLOITED

profanity < 1.60 - Use of Cryptographically Weak PRNG

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2022-40769 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including PLSRcoin.

AI-analyzed exploit summary This repository documents CVE-2022-40769, a vulnerability in the Profanity tool (up to v1.60) where weak RNG initialization allows attackers to recover private keys from Ethereum vanity addresses. It includes references and a data file but no functional exploit code.

Description

profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022.

Exploits (1)

nomisec WRITEUP 1 stars
by PLSRcoin · poc
https://github.com/PLSRcoin/CVE-2022-40769

This repository documents CVE-2022-40769, a vulnerability in the Profanity tool (up to v1.60) where weak RNG initialization allows attackers to recover private keys from Ethereum vanity addresses. It includes references and a data file but no functional exploit code.

Classification
Writeup 90%
Attack Type
Info Leak
Complexity
Moderate
Reliability
Theoretical
Target: Profanity (Ethereum vanity address tool) <= 1.60
No auth needed
Prerequisites: Access to a vanity address generated by Profanity
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/johguse/profanity/issues/61

Scores

CVSS v3 7.5
EPSS 0.0101
EPSS Percentile 58.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

VulnCheck KEV 2022-09-18
CWE
CWE-338
Status published
Products (1)
profanity_project/profanity < 1.60
Published Sep 18, 2022
Tracked Since Feb 18, 2026