CVE-2019-19752 - nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io

Back Back to CVE browser

CRITICAL

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io

Published Apr 30, 2024

9.8

CRITICAL

CVSS 3.1

EPSS 0.51%

Description

nvOC through 3.2 ships with SSH host keys baked into the installation image, which allows man-in-the-middle attacks and makes identification of all public IPv4 nodes trivial with Shodan.io. NOTE: as of 2019-12-01, the vendor indicated plans to fix this in the next image build.

Affected products

Vendor Fullzero Product Nvoc Default
affected
- Version
  3.2
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Fullzero

Nvoc

affected

Version	Status	Constraints
3.2	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-321

References (2)

Link	Providers	Tags
https://github.com/papampi/nvOC_by_fullzero_Community_Release/commits/release
https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner mitre

Published Apr 30, 2024

Updated Mar 25, 2025

Reserved Dec 12, 2019

Link CVE-2019-19752

CISA Vulnrichment

Updated Sep 16, 2024

NVD

Status Deferred

Modified Jun 17, 2026

Link CVE-2019-19752

Red Hat

Severity n/a

Public date n/a

Links CVE-2019-19752