CVE-2020-8657

EyesOfNetwork 5.3 ships with a single hard-coded API key (EONAPI_KEY in include/api_functions.php, used by API version 2.4.2) that is identical across all installations. Because the secret is baked into the source, any unauthenticated remote attacker can use it to calculate or guess a valid admin access token for the product's API, with no privileges or user interaction required (CVSS 3.1 9.8, AV:N/AC:L/PR:N/UI:N). An attacker with an admin token gains administrative control of the EyesOfNetwork API, and public proof-of-concept material for EyesOfNetwork 5.3 (a PacketStorm write-up demonstrating command execution via the AutoDiscovery component) shows how flaws in this release can be chained toward broader compromise. All EyesOfNetwork 5.3 deployments are affected, with exposure limited to installations whose API is reachable by untrusted users or the internet. The flaw is listed in CISA KEV (added 2021-11-03), confirming exploitation in the wild; EPSS estimates a 91.9% probability of exploitation within 30 days, though ransomware use is not confirmed.

What to do: Upgrade EyesOfNetwork per the vendor's instructions, as required by the CISA KEV listing. If patching is delayed, replace the default EONAPI_KEY with a unique random key, regenerate admin API tokens, and restrict access to the HTTP/API service to trusted networks. Audit API logs for admin tokens minted with the default key and check for chained exploitation via the AutoDiscovery command-execution issue, given confirmed in-the-wild activity.