Vulnerability in Nicehash Quickminer
CVE-2025-56513
NiceHash QuickMiner 6.12.0 perform software updates over HTTP without validating digital signatures or hash checks. An attacker capable of intercepting or redirecting traffic to the update url and can hijack the update process and deliver arbitrary executables that are automatically executed, resulting in full remote code execution. This constitutes a critical supply chain attack vector. NOTE: the Supplier reports that the existence of an http://update.nicehash.com URL is a fabrication, and that there is no other use of HTTP (rather than HTTPS).
EPSS: 0.004 (34.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Nicehash Quickminer — versions 6.12.0
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (Exploit)
- cve@mitre.org (Third Party Advisory)
Frequently asked questions
- What is CVE-2025-56513?
- CVE-2025-56513 is a critical-severity vulnerability in Nicehash Quickminer, classified under Download of Code Without Integrity Check. CVSS score: 9.8/10. Published 2025-09-30.
- How severe is CVE-2025-56513?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2025-56513 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.