{"id":"CVE-2025-27579","details":"In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings.","modified":"2026-08-12T15:13:47.836997Z","published":"2025-03-02T00:00:00Z","database_specific":{"cna_assigner":"mitre","cwe_ids":["CWE-352"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27579.json"},"references":[{"type":"WEB","url":"https://snotra.uk/axeos-csrf-vulnerability.html"},{"type":"WEB","url":"https://www.nobsbitcoin.com/bitaxe-firmware-esp-miner-v2-5-0/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27579.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27579"},{"type":"FIX","url":"https://github.com/skot/ESP-Miner/pull/637"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/bitaxeorg/ESP-Miner","events":[{"introduced":"0"},{"fixed":"a04c00ba070dbfc61682041d944a6fa19857a90c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.5.0"}],"source":["AFFECTED_FIELD","DESCRIPTION"]}}],"versions":["v2.4.5","v2.4.4","v2.4.3","v2.4.3b2","v2.4.3b1","v2.4.2","v2.4.2b2","v2.4.2b1","v2.4.1","v2.4.1b3","v2.4.1b2","v2.4.0b2","v2.4.0","v2.4.0b1","v2.3.1b1","v2.3.0b7","v2.3.0","v2.3.0b6","v2.3.0b5","v2.3.0b4","v2.3.0b3","v2.2.2","v2.2.1","v2.2.0","v2.1.10","v2.1.9","v2.1.8","v2.1.7","v2.1.6","v2.1.5","v2.1.4","v2.1.3","v2.1.2","v2.1.1","v2.1.0","v2.0.7","v2.0.6","v2.0.5","v2.0.4","v2.0.3","v2.0.2","v2.0.1","v2.0.0","v1.0"],"database_specific":{"vanir_signatures_modified":"2026-08-12T15:13:47Z","vanir_signatures":[{"target":{"file":"main/http_server/http_server.c","function":"POST_OTA_update"},"deprecated":false,"digest":{"function_hash":"117425552862137298526935218198231125166","length":1232},"id":"CVE-2025-27579-19199eed","signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c"},{"deprecated":false,"digest":{"function_hash":"265571103042195546018461074667353015781","length":230},"id":"CVE-2025-27579-489bd141","signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"function":"echo_handler","file":"main/http_server/http_server.c"}},{"deprecated":false,"digest":{"function_hash":"60323486346228250491807775595365065620","length":360},"id":"CVE-2025-27579-5939981a","signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"function":"POST_restart","file":"main/http_server/http_server.c"}},{"source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"file":"main/http_server/http_server.c"},"deprecated":false,"digest":{"line_hashes":["244480751629666037150751136806205757151","316904983237818168542589409205459908820","309711950232842657218859570914080482782","150949670518811521928811296487320271858","112083171654878446351641839830811321644","310798565217150351971400035009799501380","233950996322954054691024752580707747841","235928472145655116304906683654242108755","26266921249535457487984591073138173356","303642867104101915511706068300706874836","261873872586499361286900345671082496799","6962054176701614108283400373749323807","14417434479585042717693685468869744964","82254236559372802773756763330228900991","94990039587786496805187422887143094946","211760873473522476155867437517205349327","108844867524873268876896204133393964855","275617105441601736051415112197016623311","94990039587786496805187422887143094946","313729904756706155024813184276825739150","78661556131630815147330788907102687557","221807133318908885264603189335803568058","94990039587786496805187422887143094946","334494019112640453009840704173393527595","153266991967096988442243083416481736590","273227577416235618737018179325324323993","153757769438710393835270911781116060997","35339553768736063730373595651948821284","214751758919388070205014733279389248849","41740313964052717060159213196024128245","228889229866460249963318991802534970164","223637234917141591431817534876681992731","308519231509459201572675075685606244874","216115008552246272189239457407263773682","228889229866460249963318991802534970164","90152816905881810675568218936085706194","149974810021858003873197870255312501131","228456411310002017861349822379614985701","301376630698687632237995159713337218358","196482318245847967852794484650861766056","319522634840444472677612213755321351851","54557011006994140043663125532586401936","154268117566549786132837165816609920853","41924570408023754832004534886394135620","56759087805816061427060182268466130388","187242214249363096925585159420574847687","101320890716156579248618341970434834230","278615315591681044019535052804095168016","66447876209669114671042317859841199828","79406520790016592707102599220937696250","118467540477452073182500132635788277643","332108145343722433993413851444795115032","252459972544880466194047044084745085682","142315710902617605636022379444487367096","291285574437084175372178096596132414627","158915766063340010653644576787620431688","107823892661579332081885550483148047232","15977036628927854708550779872748587361","202453935545044043437634515641884154694","190102058106141950157460385929500640845","245145838584484110703471200302518624694","82001467412070861539734768953481439256","107217020745815151210979898857014146453","179178894147017638526092393792289894999","7759871166987334482016376353026149010","260764352898769237219443265881244044964","158740147832325934184739896211577404164","57025819999023023057714441841934147565","257658163608552965435604776797682196451","219100236309928304307302660507189386093","84938507811162920785700568830648095115","174679064364193363441935925382505360758","43054592422240898165508344753282931010"],"threshold":0.9},"id":"CVE-2025-27579-7a033fa9","signature_type":"Line","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"file":"main/http_server/http_server.c","function":"POST_WWW_update"},"deprecated":false,"digest":{"function_hash":"227336434050099744843291763498585578864","length":1202},"id":"CVE-2025-27579-9fec8917"},{"deprecated":false,"digest":{"function_hash":"316237739374606816369934663233422125448","length":3197},"id":"CVE-2025-27579-a5554b4f","signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"file":"main/http_server/http_server.c","function":"PATCH_update_settings"}},{"signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"file":"main/http_server/http_server.c","function":"rest_recovery_handler"},"deprecated":false,"digest":{"function_hash":"46076139298436731725707053249907169521","length":120},"id":"CVE-2025-27579-bacc4a71","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"274449569490518693246010528569340235907","length":168},"id":"CVE-2025-27579-c69fcb3e","signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"file":"main/http_server/http_server.c","function":"handle_options_request"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/bitaxeorg/ESP-Miner/commit/a04c00ba070dbfc61682041d944a6fa19857a90c","target":{"file":"main/http_server/http_server.c","function":"GET_system_info"},"deprecated":false,"digest":{"function_hash":"249567908091338272029416888894006408871","length":4533},"id":"CVE-2025-27579-fb1af45e"}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-27579.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L"}]}