CVE-2022-23650
HIGH
Published Feb 18, 20224y ago · Modified Jun 17, 20262w ago
8.8 CVSS 3.1
Published Feb 18, 2022 4y ago
Last Modified Jun 17, 2026 2w ago
Description
Netmaker is a platform for creating and managing virtual overlay networks using WireGuard. Prior to versions 0.8.5, 0.9.4, and 010.0, there is a hard-coded cryptographic key in the code base which can be exploited to run admin commands on a remote server if the exploiter know the address and username of the admin. This effects the server (netmaker) component, and not clients. This has been patched in Netmaker v0.8.5, v0.9.4, and v0.10.0. There are currently no known workarounds.
CVSS Details
Base Score
Exploitability
Impact
Vector string
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector Network
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High
Threat Intelligence
No active exploitation signals — not in CISA KEV and no EPSS score yet.
Exploit & Patch Status
No Known Exploit
Patch Available
Weaknesses 2
CWE-321
CWE-798 Use of Hard-coded Credentials Authentication
Affected Products 2
References 4
- github.com https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee
- github.com https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080
- github.com https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87
- github.com https://github.com/gravitl/netmaker/security/advisories/GHSA-86f3-hf24-76q4
Remediation
- github.com https://github.com/gravitl/netmaker/commit/3d4f44ecfe8be4ca38920556ba3b90502ffb4fee
- github.com https://github.com/gravitl/netmaker/commit/e9bce264719f88c30e252ecc754d08f422f4c080
- github.com https://github.com/gravitl/netmaker/pull/781/commits/1bec97c662670dfdab804343fc42ae4b1d050a87