EyesOfNetwork - Information Disclosure (CVE-2020-8657)
99Exploiting IPs reported
An issue was discovered in EyesOfNetwork 5.3. The installation uses the same API key (hardcoded as EONAPI_KEY in include/api_functions.php for API version 2.4.2) by default for all installations, hence allowing an attacker to calculate/guess the admin access token.
CrowdSec analysis
CVE-2020-8657 is a critical vulnerability in EyesOfNetwork 5.3 where a hardcoded API key is used across all installations, making it trivial for attackers to guess or calculate the admin access token. This flaw enables remote attackers to gain unauthorized administrative access, potentially leading to full system compromise.
CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2020-8657 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. In addition, according to the CrowdSec network, attack volume against CVE-2020-8657 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers exploit the EyesOfNetwork API by sending POST requests to /eonapi/createEonUser with a hardcoded or predictable apiKey parameter, allowing unauthorized creation of administrative users.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.