CVE-2017-16929: The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated director

This week

HIGH 8.1DOWNGRADE

CVE-2017-16929 is a high-severity flaw (CVSS 8.1) affecting claymore dual miner. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a remote attacker to read/write arbitrary files. This can be exploited via ../ sequences in the pathname to miner_file or miner_getfile.

Why this priority

High severity
EPSS top 4%: very likely to be exploited
Public exploit reference

No fix is published yet: follow the downgrade or mitigation steps.

Risk facts

CVSS score	8.1 (High)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	Low
User interaction	None
EPSS exploit chance	12.9% (top 4%)
CISA exploited list	No
Weakness	CWE-22, CWE-119
Published	2017-12-05
Last modified	2026-06-17

Publisher (CNA): MITRE · Vendor: claymore dual miner project

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-12-05 09:29 UTCPublished CVE record published
2026-06-17 01:10 UTCUpdated Record last modified

claymore dual miner project claymore dual miner DOWNGRADE

Affected: 10.1

Fixed in: no fixed release known

Safe to downgrade to: a release before 10.1

1. Check installed version

apt-cache policy claymore-dual-miner || rpm -q claymore-dual-miner || claymore-dual-miner --version

2. No fixed release: DOWNGRADE to a release before 10.1 (Debian / Ubuntu)

apt-cache madison claymore-dual-miner sudo apt install claymore-dual-miner=<VERSION_BEFORE_10.1> sudo apt-mark hold claymore-dual-miner

2. No fixed release: DOWNGRADE (RHEL / Amazon Linux / Fedora)

dnf --showduplicates list claymore-dual-miner sudo dnf downgrade claymore-dual-miner-<VERSION_BEFORE_10.1> sudo dnf versionlock add claymore-dual-miner

Downgrade risk

Downgrading can break dependent software and may reopen older bugs. Read the distro advisory first and test on a non-production host.

After downgrade

Restart the service, and keep the package held until a fixed release ships.

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Exploit-DB: Claymore Dual ETH + DCR/SC/LBC/PASC GPU Miner - Stack Buffer Overflow / Path Traversal

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-16929?

claymore dual miner: downgrade or apply the listed mitigation. Exact commands for each OS are on this page.

Is CVE-2017-16929 being exploited?

CVE-2017-16929 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-16929 affect?

CVE-2017-16929 affects claymore dual miner. Severity is high (CVSS 8.1). The remote management interface on the Claymore Dual GPU miner 10.1 is vulnerable to an authenticated directory traversal vulnerability exploited by issuing a specially crafted request, allowing a remote attacker to read/write arbitrary fil

How urgent is CVE-2017-16929?

Priority 57/100. High severity; EPSS top 4%: very likely to be exploited; Public exploit reference

Related CVEs

CVE-2018-6317 CRITICAL 9.1 UPGRADE The remote management interface in Claymore Dual Miner 10.5 and earlier is vulnerable to an unauthenticated fo
CVE-2018-1000049 HIGH 7.5 UPGRADE Nanopool Claymore Dual Miner version 7.3 and earlier contains a remote code execution vulnerability by abusing
CVE-2017-16930 CRITICAL 9.8 DOWNGRADE The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker

References

← Back to latest CVEs