CVE-2025-56513 PoC — NiceHash QuickMiner 安全漏洞

Source

https://github.com/psycho-prince/CVE-2025-56513-NiceHash-Update-Chain-Compromise

Associated Vulnerability

Title: NiceHash QuickMiner 安全漏洞 (CVE-2025-56513)
Description:NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution. This constitutes a critical supply chain attack vector. NOTE: the Supplier reports that the existence of an http://update.nicehash.com URL is a fabrication, and that there is no other use of HTTP (rather than HTTPS).

Description

Critical supply-chain vulnerability research on NiceHash QuickMiner update mechanism (CVE-2025-56513). Includes technical analysis, attack scenarios, impact assessment, and remediation guidance.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →