---
id: "CVE-2020-8657"
kind: "vulnerability"
aliases: ["CVE-2020-8657"]
title: "EyesOfNetwork EyesOfNetwork: EyesOfNetwork Use of Hard-Coded Credentials Vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.91874
exploited: true
status: "open"
category: "package"
products: [{"name": "EyesOfNetwork EyesOfNetwork", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exploited", "eyesofnetwork", "network-monitoring", "package", "self-hosted"]
not_affected_if: ["default-config-changed"]
published_at: "2020-02-06T18:15:13+00:00"
first_seen_at: "2026-10-23T19:11:53+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8657", "first_seen_at": "2026-10-23T19:11:53+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-8657", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8657", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# EyesOfNetwork EyesOfNetwork: EyesOfNetwork Use of Hard-Coded Credentials Vulnerability

EyesOfNetwork, a network monitoring product, ships with the same default API key on every install. An attacker who knows or can guess that key can derive the admin access token and act as an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EyesOfNetwork EyesOfNetwork affected ? fixed ?

## Fix

Apply the vendor update per CISA guidance; change the default API key on every install. Vendor instructions not in sources.

## Timeline

- 2026-10-23T19:11:53+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2020-8657
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-8657
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-8657

## From the sources

An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_