PT-2022-16161 · Netmaker · Netmaker

Afeiszli · Published 2022-02-18 · Updated 2026-05-18 · CVE-2022-23650

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Netmaker versions prior to 0.8.5 Netmaker versions prior to 0.9.4 Netmaker versions prior to 0.10.0

Description The issue is related to a hard-coded cryptographic key in the code base of Netmaker, a platform for creating and managing virtual overlay networks using WireGuard. This key can be exploited to run admin commands on a remote server if the address and username of the admin are known. The server component of Netmaker is affected, but not the clients.

Recommendations To resolve the issue for versions prior to 0.8.5, upgrade to Netmaker version 0.8.5 or later by performing the following steps:

1. docker-compose down
2. docker pull gravitl/netmaker:(version)
3. docker-compose up -d To resolve the issue for versions prior to 0.9.4, upgrade to Netmaker version 0.9.4 or later by performing the same steps as above. To resolve the issue for versions prior to 0.10.0, upgrade to Netmaker version 0.10.0 or later by performing the same steps as above. If running any other version, upgrade to one of the patched versions (0.8.5, 0.9.4, or 0.10.0).

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-321

CWE-798

Related Identifiers

CVE-2022-23650

GHSA-86F3-HF24-76Q4

GO-2022-0328

Affected Products

Netmaker

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/23xxx/CVE-2022-23650.json · Exploit
• https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080 · Patch
• https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee · Patch
• https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-23650 · Security Note
• https://osv.dev/vulnerability/CVE-2022-23650 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-86f3-hf24-76q4 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2022-0328 · Vendor Advisory
• https://github.com/gravitl/netmaker · Note
• https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4 · Note
• https://t.me/cibsecurity/37801 · Telegram Post
• https://t.me/cveNotify/163871 · Telegram Post