Your Goldshell BOX has no lock on the door

The web UI on a Goldshell SC Box asks for a password before it lets you change anything. The API behind that UI does not. We found this while flashing ours to firmware 2.2.5, reported it to Goldshell by email on September 4, and are publishing it now so other owners can close the door themselves.

What we confirmed

On our SC Box, firmware 2.2.5, control board MCB_V5_4, from a machine on the same LAN, with no login and no session cookie:

• Reads work. GET /mcb/status, GET /mcb/setting and the cgminer passthrough (/mcb/cgminer?cgminercmd=...) return the box’s state, settings and configured pool list, including the pool URL and worker name.
• At least one write works. PUT /mcb/wifisetting with {"enable": false} turned the box’s WiFi radio off. No password was asked for and the change took effect.

The UI has a password and a lock control, so authentication is intended. The device does not enforce it on the API the UI talks to. The reads answered the same way on 2.2.1 before the flash; the write we only sent on 2.2.5.

What we did not test, on purpose

The API also has endpoints that change pools, factory-reset the box and upload firmware. We did not send unauthenticated requests to those, because a wrong result on our only miner is a bricked miner. We do not know whether they check for a password. If they behave like the WiFi endpoint, anyone on your network can repoint your hashrate to their pool, wipe your configuration, or flash what they like. Treat that as the risk until Goldshell says otherwise.

Why “on your network” is worse than it sounds

Out of the box the SC Box runs its own WiFi access point, an SSID like Goldshell-xxxx, with no password. Anyone who joins it is on the box’s network. So until that radio is off, “someone on the LAN” includes anyone within WiFi range of the box, without ever touching your router.

The well-known part of this is the factory password, which the web UI asks for and which most boxes still carry. The part we had not seen written down is that the API does not ask at all.

What to do today

1. Turn the access point off. The UI’s WLAN toggle is greyed out on a wired box, so use the API from a machine on the LAN:

   curl -X PUT -H "Content-Type: application/json" \
        -d '{"enable":false}' http://<box-ip>/mcb/wifisetting

   Confirm with curl http://<box-ip>/mcb/wifisetting, and check that the Goldshell-xxxx network is gone from a phone. The box stays reachable on ethernet.

2. Never put the box on a network that reaches the internet directly. No port forwards, no DMZ, no exposing the web UI. The only connection it needs is the LAN path to your DATUM gateway.

3. Block its internet access at the router anyway. The firmware phones home to Goldshell’s discovery service; it does not need to.

4. Put it on its own VLAN or guest network with your node if your router can, so a compromised laptop or phone on the house WiFi cannot reach it.

5. Change the UI password if you have not. It protects the UI, and it is the one lock that does exist.

Disclosure

Reported to Goldshell on September 4, 2026, by email to their published contact address, with their parent company Intchains in copy, before this post was written. We offered to share detail with their engineers and to coordinate timing. No reply as of publication; this line will be updated if one comes. We are one owner with one box, not a security firm, and we have not tested any other model. If your HS Box or another BOX model behaves differently, say so and this post gets a dated correction.

Discuss this post on X

Saved you an hour? Tip the node and the clankers.