CVE-2018-1000093 | BDVDB-2026-97765 Detail

Description#

CryptoNote version version 0.8.9 and possibly later contain a local RPC server which does not require authentication, as a result the walletd and the simplewallet RPC daemons will process any commands sent to them, resulting in remote command execution and a takeover of the cryptocurrency wallet if an attacker can trick an application such as a web browser into connecting and sending a command for example. This attack appears to be exploitable via a victim visiting a webpage hosting malicious content that trigger such behavior.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12018-03-13Record published in the CVE List.
2. Version 22024-08-05Most recent update recorded in the CVE List.