CVE-2022-23650 Use of Hard-coded Cryptographic Key in Netmaker

What is CVE-2022-23650?

CVE-2022-23650 is a high-severity vulnerability in gravitl netmaker, published on 18 Feb 2022. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

Weakness: CWE-798, CWE-321

Which versions are affected by CVE-2022-23650?

5 open source packages ship an affected version, including github.com/gravitl/netmaker. It affects 1 product.

Products include Netmaker Netmaker.

How do I fix CVE-2022-23650?

Upgrade github.com/gravitl/netmaker to a fixed version for your release line: 0.8.5 or 0.9.4.

Is CVE-2022-23650 being exploited?

There is no known exploitation of CVE-2022-23650 in the wild and no public exploit code.

Other vulnerabilities in gravitl netmaker

• CVE-2023-32079 Netmaker Privilige Escalation Vulnerability High 8.8
• CVE-2022-36110 Netmaker vulnerable to Insufficient Granularity of Access Control High 8.8
• CVE-2022-0664 Use of Hard-coded Cryptographic Key in gravitl/netmaker High 8.8
• CVE-2026-29771 Netmaker: Denial of Service via Server Shutdown Endpoint High 8.7
• CVE-2026-38651 Netmaker does not verify JWT signatures for host tokens High 8.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-86f3-hf24-76q4, GO-2022-0328.