CVE-2020-8657: EyesOfNetwork hardcoded API key allows admin token forgery

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, CISA KEV listing, very high EPSS probability and a public exploit make this an actively exploited, remotely reachable authentication bypass.

What it is

EyesOfNetwork 5.3 ships with a hardcoded API key (EONAPI_KEY in include/api_functions.php for API version 2.4.2) that is identical across all installations. Because the admin access token is derived from this static value, an attacker who knows the key can calculate or guess a valid admin token. This undermines authentication for the entire product and exposes administrative functionality to unauthenticated remote users.

Impact

An attacker gains administrative access to the EyesOfNetwork API, enabling full control over the monitored environment and, per the linked exploit reference, command execution via the AutoDiscovery target. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network through the EyesOfNetwork API; the CVSS vector is AV:N/AC:L/PR:N/UI:N, so no authentication and no user interaction are required. The only prerequisite is knowledge of the default hardcoded key, which is public in the source.

Exploitation

CVE-2020-8657 is listed in CISA KEV (added 2021-11-03) and has an EPSS 30-day probability of 0.91874 (99.8th percentile), indicating active exploitation. A public exploit reference is tagged Exploit on Packet Storm.

What to do

• Apply the vendor update that removes or rotates the hardcoded EONAPI_KEY; treat this as the first action.
• If patching cannot be done immediately, change the default API key on every EyesOfNetwork installation and rotate any admin tokens derived from it.
• Restrict network access to the EyesOfNetwork API to trusted management hosts only.
• Audit EyesOfNetwork accounts and tokens for unauthorized administrative use and reset credentials.
• Monitor vendor and CISA guidance for the required KEV remediation deadline (2022-05-03).

Detection

• Search EyesOfNetwork logs for API authentication using the default key or for admin token generation from unexpected source IPs.
• Alert on administrative API calls, especially AutoDiscovery target configuration, originating from hosts outside the management network.
• Hunt for the hardcoded string EONAPI_KEY in deployed include/api_functions.php files to identify unpatched instances.
• Correlate outbound or lateral connections from EyesOfNetwork servers with command execution or discovery activity.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.