CVE-2022-23650

Katalog CVE

CVSS 8.8 · High EPSS 1,6%

Kerentanan Use of Hard-coded Cryptographic Key pada netmaker. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.

Rincian

Terbit di NVD

18 Februari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-321: Use of Hard-coded Cryptographic Key
CWE-798: Use of Hard-coded Credentials

EPSS (30 hari)

1,6% peluang dieksploitasi; lebih tinggi dari 74,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee patch · advisory pihak ketiga
• https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080 patch · advisory pihak ketiga
• https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87 patch · advisory pihak ketiga
• https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4 advisory pihak ketiga