CVE-2020-8657

EyesOfNetwork Use of Hard-Coded Credentials Vulnerability

Exploited in attacks Critical 9.8 Attack chance: 92%

What it is

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.

CISA: EyesOfNetwork contains a use of hard-coded credentials vulnerability, as it uses the same API key by default. Exploitation allows an attacker to calculate or guess the admin access token.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: May 3, 2022

Added to the CISA list: November 3, 2021
Published: February 6, 2020
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 92% in the top 0.2% of all known vulnerabilities
Weakness: CWE-798
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from EyesOfNetwork

Added	Vulnerability	Product	Severity	Attack chance
Nov 3, 2021	Improper Privilege ManagementCVE-2020-8655	EyesOfNetwork	High 7.8	60%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.