Security readout for executives and security teams
Plain-English summary
This is a low-severity timing weakness in legacy Ziftr primecoin RPC authentication. An attacker with limited prerequisites might infer small information from response timing, but sources describe exploitation as difficult and high complexity. The fix is to upgrade to version 0.8.4rc2.
Executive priority
Treat this as a cleanup item, not an emergency. Prioritize it if legacy primecoin software is still running or RPC access is broadly reachable. Otherwise, track remediation through normal vulnerability management.
Technical view
CVE-2013-10006 is CWE-208 in HTTPAuthorized in src/bitcoinrpc.cpp. Comparing strUserPass and strRPCUserColonPass could create observable timing differences. CVSS 3.1 is 2.6 with adjacent-network attack vector, high complexity, low privileges, no user interaction, and limited confidentiality impact.
Likely exposure
Exposure appears limited to systems running Ziftr primecoin up to 0.8.4rc1 where the RPC interface is reachable by an attacker meeting the stated prerequisites. Modern environments are unlikely to be affected unless they still operate this legacy software.
Exploitation context
The source bundle does not report active exploitation, and KEV status is false. VulDB describes attack complexity as high and exploitation as difficult. No public source in the bundle provides evidence of weaponized exploitation.
Researcher notes
Evidence supports a timing discrepancy in an authentication helper, not direct credential disclosure. The bundle identifies the patched release and commit but does not include exploit mechanics or independent exploitation reports.
Mitigation direction
- Upgrade Ziftr primecoin to version 0.8.4rc2.
- Apply or verify patch cdb3441b5cd2c1bae49fae671dc4a496f7c96322.
- Restrict RPC interface reachability to trusted hosts only.
- Review vendor guidance before making unsupported local code changes.
Validation and detection
- Inventory any Ziftr primecoin deployments and confirm installed version.
- Verify the patch commit is present in deployed source or binaries.
- Confirm RPC endpoints are not exposed beyond intended trusted networks.
- Document any remaining 0.8.4rc1 systems as accepted legacy risk.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-208: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2013-10006 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Low
- CVSS
- 2.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N1.21.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
2.6LowVector: CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://vuldb.com/?id.217171CVE reference · vdb-entry, technical-description
- https://vuldb.com/?ctiid.217171CVE reference · signature, permissions-required
- https://github.com/Ziftr/primecoin/commit/cdb3441b5cd2c1bae49fae671dc4a496f7c96322CVE reference · patch
- https://github.com/Ziftr/primecoin/releases/tag/v0.8.4rc2CVE reference · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Observable Timing Discrepancy
Observable Timing Discrepancy represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.