The vulnerability CVE-2025-56513 concerns NiceHash QuickMiner 6.12.0's update mechanism, which reportedly uses HTTP without verifying update integrity via digital signatures or hash checks. This flaw could enable a man-in-the-middle attacker to hijack the update process and execute arbitrary code remotely. The supplier disputes the claim, stating there is no HTTP update URL and that updates occur over HTTPS, implying the reported attack vector may be inaccurate or fabricated. The CVSS 3.1 base score is 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting critical impact if the vulnerability is valid. There is no information on affected versions beyond the single version mentioned, no patch links, and no known active exploitation.

If the vulnerability is valid, it allows unauthenticated remote attackers to execute arbitrary code with full privileges by hijacking the software update process. This could lead to complete system compromise via supply chain attack. However, the supplier's denial of the HTTP update URL existence suggests the reported attack vector may not be present in actual deployments, potentially mitigating the risk. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The supplier denies the existence of the vulnerable HTTP update mechanism, indicating no action may be required if their statement is accurate. Users should verify update sources and ensure updates are received over secure channels (HTTPS). Monitor official vendor communications for any updates or patches addressing this issue.