CVE-2020-9465: EyesOfNetwork eonweb SQL injection allows unauthenticated auth bypass

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 9.8 with no authentication or user interaction required, public exploit references and a very high EPSS score make this an urgent patch target.

What it is

EyesOfNetwork eonweb versions 5.1 through 5.3 before 5.3-3 contain a SQL injection in the web interface. The user_id field in a cookie is injectable, letting an unauthenticated attacker run arbitrary SQL and bypass authentication. It matters because the vulnerable component is the management interface itself, so compromise can expose the whole monitoring platform.

Impact

An attacker gains authentication bypass and the ability to perform arbitrary database tasks, which can lead to full control of the eonweb application and its data. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reachable over the network through the eonweb web interface by manipulating the user_id cookie value. No authentication or user interaction is required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).

Exploitation

No CISA KEV listing, but EPSS is 0.82244 (99.64th percentile) and the references include an Exploit-tagged GitHub issue, indicating public exploit material exists and exploitation is likely.

What to do

• Upgrade eonweb to 5.3-3 or later, which the vendor release notes identify as the fixed version.
• If immediate upgrade is not possible, restrict network access to the eonweb web interface to trusted management networks only.
• Use parameterized queries or strict validation for the user_id cookie value in any interim code fix.
• Review database and application logs for unauthorized queries or authentication anomalies while the system remains unpatched.

Detection

• Inspect web server and application logs for requests with unusual or SQL-like content in the user_id cookie.
• Alert on authentication events that succeed without a preceding valid login or from unexpected source addresses.
• Monitor database logs for unexpected queries, errors or schema access originating from the eonweb host.
• Hunt for known exploit patterns against the eonweb interface in HTTP request logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.