CVE-2020-8657 EyesOfNetwork Use of Hard-Coded Credentials

Exploited in the wild Critical 9.8 Published 6 Feb 2020 Updated 21 Oct 2025

Attackers can guess admin access tokens due to a hardcoded API key, leading to unauthorized administrative access in EyesOfNetwork.

Exploited in the wild: Since 3 Nov 2021
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-8657?

CVE-2020-8657 is a critical vulnerability in n/a, published on 6 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.

Weakness: CWE-798

Which versions are affected by CVE-2020-8657?

It affects 1 product.

Products include Eyesofnetwork Eyesofnetwork.

How do I fix CVE-2020-8657?

No fix has been published for CVE-2020-8657 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 3 May 2022.

Is CVE-2020-8657 being exploited?

Yes. Attackers have exploited CVE-2020-8657 in the wild since at least 3 Nov 2021.

Public exploit code: 1 Metasploit module, 1 Exploit-DB entry and 1 Nuclei template.

Sources

Also known as GHSA-3w5r-gmmj-prc2.