PT-2020-6507 · Unknown · Eyesofnetwork

H4Knet · Published 2020-02-05 · Updated 2025-11-10 · CVE-2020-8657

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions EyesOfNetwork version 5.3

Description The issue is related to the use of a hardcoded API key, EONAPI KEY, in the include/api functions.php file for API version 2.4.2. This allows an attacker to calculate or guess the admin access token, potentially leading to unauthorized access to protected information and privilege escalation.

Recommendations For EyesOfNetwork version 5.3, consider changing the default API key EONAPI KEY to a unique value to prevent unauthorized access. As a temporary workaround, restrict access to the API endpoint that uses the hardcoded EONAPI KEY until a patch is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

BDU:2021-05687

CVE-2020-8657

Affected Products

Eyesofnetwork

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/eyesofnetwork_autodiscovery_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/48169 · Exploit
• 🔥 http://packetstormsecurity.com/files/156605/EyesOfNetwork-AutoDiscovery-Target-Command-Execution.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-8657 · Security Note
• https://bdu.fstec.ru/vul/2021-05687 · Security Note
• https://osv.dev/vulnerability/CVE-2020-8657 · Vendor Advisory
• https://github.com/EyesOfNetworkCommunity/eonapi/issues/17 · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-8657 · Note
• https://twitter.com/pdnuclei_bot/status/1970382661756821861 · Twitter Post
• https://t.me/cveNotify/142275 · Telegram Post