What’s Vulnerable › Vulnerabilities

CVE-2019-19750

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-12-12 · updated 2026-06-17
• Weakness: CWE-321

Description

minerstat msOS before 2019-10-23 does not have a unique SSH key for each instance of the product.

Affected products

• Minerstat Msos: before 2019-10-23 — fixed in 2019-10-23

How to fix

Upgrade to a fixed version: Minerstat Msos 2019-10-23. Check the vendor advisory for mitigations.

References

• https://github.com/minerstat/minerstat-os/commit/487ebd652dc9dc81120809effb2ddb3f66fc5f14
• https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html
• https://github.com/minerstat/minerstat-os/commit/487ebd652dc9dc81120809effb2ddb3f66fc5f14
• https://rsaxvc.net/blog/2020/4/10/Widespread_re-use_of_SSH_Host_Keys_in_Ethereum_Mining_Rig_Operating_Systems.html

Get alerted when CVE-2019-19750 or the next vulnerability affects your stack