CVE-2020-8657criticalunder attackCWE-798

CVE-2020-8657

Published · Updated

Follow this CVE+ Monitor EyesOfNetwork

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 92%
from disclosure to weapon28 days
Published on NVDFeb 6
1st PoC+28d
metasploitFeb 6
CISA KEV+636d
Action required by CISAfederal deadline: 2022-05-03

Apply updates per vendor instructions.

In short

EyesOfNetwork 5.3 uses the same hardcoded API key for all installations by default, allowing attackers to guess the admin access token and gain unauthorized control.

Technical detail

The application employs a hardcoded, identical API key across all default installations (CWE-798: Use of Hard-coded Credentials). An unauthenticated attacker can derive valid admin authentication tokens without requiring any legitimate credentials, leading to complete compromise of the monitoring system.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.