CVE-2020-8657
EyesOfNetwork Use of Hard-Coded Credentials Vulnerability
Description
CVE-2020-8657 is a CRITICAL use of hard-coded credentials vulnerability in EyesOfNetwork 5.3 with a CVSS 3.1 score of 9.8. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default across all installations, allowing an attacker to calculate or guess the admin access token and gain full administrative control. Affected products include EyesOfNetwork version 5.3-0. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2022-05-03. The EPSS score of 0.90304 (99.599th percentile) indicates extremely high exploitation probability.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| eyesofnetwork | eyesofnetwork | 5.3-0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://github.com/EyesOfNetworkCommunity/eonapi/issues/17(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8657(US Government Resource)
Weakness Type
CWE-798: Use of Hard-Coded Credentials
CVE-2020-8657 is classified under CWE-798 — Use of Hard-Coded Credentials. This weakness occurs when software contains hard-coded credentials such as passwords, API keys, cryptographic keys, or other authentication secrets embedded directly in the source code. These credentials are identical across all installations and cannot be changed without modifying the source code, making them trivially discoverable through reverse engineering, code review, or binary analysis.
In the context of EyesOfNetwork, the EONAPI_KEY value was hardcoded in the PHP source file include/api_functions.php. This key is used to generate authentication tokens for the REST API, including administrative access tokens. Since every EyesOfNetwork 5.3 installation uses the identical key, an attacker who obtains or deduces this value can forge valid admin authentication tokens for any EyesOfNetwork deployment. This fundamentally breaks the authentication model of the entire product.
Learn more: CWE-798 — Use of Hard-Coded Credentials
Impact Analysis
CVE-2020-8657 carries a CVSS 3.1 score of 9.8 (CRITICAL) with Unchanged Scope.
Confidentiality (HIGH): An attacker who forges an admin token gains complete access to the EyesOfNetwork monitoring platform, including all monitored infrastructure details, network topology, host configurations, SNMP credentials, and any sensitive operational data collected by the monitoring system.
Integrity (HIGH): With administrative access, attackers can modify monitoring configurations, suppress alerts for ongoing attacks, inject false monitoring data, alter user accounts and permissions, and potentially leverage the monitoring system to execute commands on monitored hosts.
Availability (HIGH): Attackers can disable monitoring for the entire infrastructure, delete historical monitoring data, shut down the EyesOfNetwork service, or weaponize the platform against the monitored environment.
The impact is amplified by the nature of network monitoring platforms, which typically have broad network access and visibility into critical infrastructure. Compromising such a system provides attackers with detailed reconnaissance information and potentially a foothold for lateral movement.
Exploit Maturity
CVE-2020-8657 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Public exploit code is available, including entries in PacketStorm Security. The exploitation is straightforward since the hardcoded API key is publicly known and documented. An attacker simply needs to use this key to generate a valid admin token, requiring no sophisticated techniques.
Ransomware association: No direct ransomware association has been confirmed for CVE-2020-8657 as of the latest KEV data. However, the administrative access gained through exploitation enables full system compromise, which could facilitate ransomware deployment.
Attack surface: Any internet-exposed or internally-accessible EyesOfNetwork 5.3 installation with the default API key is vulnerable. The EPSS score of 0.90304 (99.599th percentile) reflects high exploitation activity.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2022-05-03.
Remediation
- Update EyesOfNetwork immediately. Apply updates per vendor instructions to receive a version that generates unique API keys per installation. Check the GitHub issue for guidance.
- Change the default API key. If updating is not immediately possible, manually replace the hardcoded EONAPI_KEY value in include/api_functions.php with a unique, cryptographically random key. Ensure the new key is sufficiently long and unpredictable.
- Restrict network access to the EyesOfNetwork API. Limit access to the API endpoints to trusted management networks only. Implement firewall rules and network segmentation to prevent unauthorized access.
- Audit for unauthorized access. Review API access logs for signs of token forgery or unauthorized administrative actions. Check for modifications to monitoring configurations, suppressed alerts, or new user accounts.
- Rotate all credentials stored in EyesOfNetwork. Any SNMP community strings, SSH credentials, or other authentication secrets stored in the monitoring platform should be rotated, as they may have been exposed.
- Implement additional authentication layers. Consider placing the EyesOfNetwork web interface behind a reverse proxy with additional authentication requirements such as client certificates or multi-factor authentication.
Technical Details
CVE-2020-8657 is a CRITICAL vulnerability in EyesOfNetwork that can be exploited remotely without authentication or user interaction. The attack complexity is low.
Technical mechanism: EyesOfNetwork version 5.3 uses a hardcoded API key (EONAPI_KEY) defined in the file include/api_functions.php for its REST API (version 2.4.2). This key is identical across every default installation of EyesOfNetwork 5.3. The API key is used as a secret input for generating authentication tokens, including administrative access tokens.
Exploitation flow: An attacker obtains the hardcoded EONAPI_KEY value (which is publicly documented in the source code). Using this key, the attacker calculates a valid administrative authentication token by replicating the token generation algorithm. The forged token is then used to authenticate against the EyesOfNetwork REST API with full administrative privileges, bypassing all authentication controls.
CVSS 3.1 vector analysis (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): Network-accessible, low complexity, no privileges needed, no user interaction required. Unchanged scope means the impact is contained within the EyesOfNetwork platform.
Affected products: EyesOfNetwork (5.3-0).
Frequently Asked Questions
Is CVE-2020-8657 being actively exploited?
Yes, CVE-2020-8657 is actively exploited and listed in CISA's KEV catalog. The hardcoded API key is publicly known, making exploitation trivial for any attacker who can reach the EyesOfNetwork API. The EPSS score of 0.90304 (99.599th percentile) confirms very high exploitation activity.
What products are affected by CVE-2020-8657?
EyesOfNetwork version 5.3-0 is confirmed affected. All default installations of this version use the same hardcoded API key, making them uniformly vulnerable. Organizations should check if their EyesOfNetwork installations have the default EONAPI_KEY value.
How do I fix CVE-2020-8657?
Update EyesOfNetwork to a version that generates unique API keys. If immediate updating is not possible, manually change the hardcoded EONAPI_KEY in include/api_functions.php to a unique random value. Restrict API access to trusted networks and audit for unauthorized administrative activity.
How severe is CVE-2020-8657?
CVE-2020-8657 is rated CRITICAL with a CVSS score of 9.8. It allows unauthenticated attackers to gain full administrative access to any default EyesOfNetwork 5.3 installation by exploiting a hardcoded API key. The EPSS score of 0.90304 (99.599th percentile) reflects extremely high exploitation likelihood. CISA set a remediation deadline of 2022-05-03.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.