How severe is CVE-2020-8655?

CVE-2020-8655 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2020-8655 being actively exploited?

Yes. CVE-2020-8655 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.

What products are affected by CVE-2020-8655?

CVE-2020-8655 affects Eyesofnetwork. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-8655?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.

Does CVE-2020-8655 have an EU (EUVD) identifier?

Yes. CVE-2020-8655 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-29503. It is also flagged as exploited in the EUVD (since 2021-11-03).

When was CVE-2020-8655 published?

CVE-2020-8655 was published on 2020-02-07 and last updated on 2026-06-17.

CVE-2020-8655

CVE-2020-8655 is a high-severity vulnerability in Eyesofnetwork with a CVSS 3.x base score of 7.8. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2021-11-03). The underlying weakness is classified as CWE-269.

Key facts

Severity: High (CVSS 3.x base score 7.8)
CVSS v2: 9.3
EPSS exploit prediction: 58% (99th percentile)
Actively exploited: Yes — listed in CISA KEV (added 2021-11-03)
EU (EUVD) id: EUVD-2020-29503
EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2021-11-03)
Weakness: CWE-269
Affected product: Eyesofnetwork
Published: 2020-02-07
Last modified: 2026-06-17

Description

An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.

Frequently asked questions

What is CVE-2020-8655?: An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to run arbitrary commands as root via a crafted NSE script for nmap 7.
How severe is CVE-2020-8655?: CVE-2020-8655 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires no privileges and user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2020-8655 being actively exploited?: Yes. CVE-2020-8655 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2021-11-03, which means active exploitation has been confirmed. It should be prioritised for remediation.
What products are affected by CVE-2020-8655?: CVE-2020-8655 affects Eyesofnetwork. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-8655?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
Does CVE-2020-8655 have an EU (EUVD) identifier?: Yes. CVE-2020-8655 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2020-29503. It is also flagged as exploited in the EUVD (since 2021-11-03).
When was CVE-2020-8655 published?: CVE-2020-8655 was published on 2020-02-07 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:eyesofnetwork:eyesofnetwork:5.3-0:*:*:*:*:*:*:*

More vulnerabilities in Eyesofnetwork

CVE-2022-41572 — Critical (CVSS 9.8): An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Privilege escalation can be accomplished on the server…
CVE-2022-41571 — Critical (CVSS 9.8): An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Local file inclusion can occur.
CVE-2022-41570 — Critical (CVSS 9.8): An issue was discovered in EyesOfNetwork (EON) through 5.3.11. Unauthenticated SQL injection can occur.
CVE-2021-40643 — Critical (CVSS 9.8): EyesOfNetwork before 07-07-2021 has a Remote Code Execution vulnerability on the mail options configuration page. In…
CVE-2021-27514 — Critical (CVSS 9.8): EyesOfNetwork 5.3-10 uses an integer of between 8 and 10 digits for the session ID, which might be leveraged for…
CVE-2020-27886 — Critical (CVSS 9.8): An issue was discovered in EyesOfNetwork eonweb 5.3-7 through 5.3-8. The eonweb web interface is prone to a SQL…

All CVEs affecting Eyesofnetwork →

Other CWE-269 (Improper Privilege Management) vulnerabilities

CVE-2026-31852 — Critical (CVSS 10.0): Jellyfin is an open-source media system. The code-quality.yml GitHub Actions workflow in jellyfin/jellyfin-ios is…
CVE-2025-20282 — Critical (CVSS 10.0): A vulnerability in an internal API of Cisco ISE and Cisco ISE-PIC could allow an unauthenticated, remote attacker to…
CVE-2025-0505 — Critical (CVSS 10.0): On Arista CloudVision systems (virtual or physical on-premise deployments), Zero Touch Provisioning can be used to gain…
CVE-2023-48418 — Critical (CVSS 10.0): In checkDebuggingDisallowed of DeviceVersionFragment.java, there is a possible way to access adb before SUW…
CVE-2023-48419 — Critical (CVSS 10.0): An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in Elevation of Privilege
CVE-2023-31273 — Critical (CVSS 10.0): Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to…

Browse all CWE-269 (Improper Privilege Management) vulnerabilities →