The flaw in Go Ethereum’s ECIES cryptography module allows a remote adversary to exploit insufficient public key validation during the RLPx handshake, enabling the extraction of partial bits of a node’s private key. This leakage can compromise a node’s ability to sign p2p messages, potentially permitting an attacker to masquerade as the node in the Ethereum network. The weakness is categorized as CWE‑203, indicating an improper handling of sensitive data that can lead to information disclosure.

All Go Ethereum (Geth) instances running versions earlier than 1.16.9, including the 1.17.x series prior to release 1.17.0, are susceptible. The vulnerability impacts the default node key stored at <datadir>/geth/nodekey in the standard Geth distribution provided by the ethereum:go-ethereum project.

The CVSS score of 6.9 signifies a moderate impact, while the EPSS score of less than 1% indicates a low likelihood of current exploitation. Although the vulnerability is externally accessible over the network and does not require local privileges, it is not listed in the CISA KEV catalog, suggesting no widespread publicly known exploitation. Attackers could target an open node by initiating an RLPx handshake and observing the malformed ECIES public key. Based on the description, the likely vector is remote over the Ethereum peer-to-peer network.