CVE-2025-27579

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

In Bitaxe ESP-Miner before 2.5.0 with AxeOS, one can use an /api/system CSRF attack to update the payout address (aka stratumUser) for a Bitaxe Bitcoin miner, or change the frequency and voltage settings.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:L

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published: Mar 3, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-275807.5NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 generates predictable tokens (that depend on username, ti CVE-2025-275814.3NIH BRICS (aka Biomedical Research Informatics Computing System) through 14.0.0-67 allows users who lack the InET role to access the InET mo CVE-2025-275827.6The Secure Password extension in One Identity Password Manager before 5.14.4 allows local privilege escalation. The issue arises from a flaw CVE-2025-275839.1Incorrect access control in the component /rest/staffResource/findAllUsersAcrossOrg of Serosoft Solutions Pvt Ltd Academia Student Informati CVE-2025-275845.4A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al CVE-2025-275855.4A stored cross-site scripting (XSS) vulnerability in Serosoft Solutions Pvt Ltd Academia Student Information System (SIS) EagleR v1.0.118 al CVE-2025-275875.3OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of r CVE-2025-27597.8GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate pr CVE-2025-275909.8In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux us CVE-2025-275916.8A privilege escalation vulnerability existed in the Below service prior to v0.9.0 due to the creation of a world-writable directory at /var/CVE-2025-275939.3The product can be used to distribute malicious code using SDD Device Drivers due to missing download verification checks, leading to code e CVE-2025-275947.5The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device