PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-0664 gravitl CVE debrief

A critical vulnerability in Netmaker, a WireGuard-based virtual networking platform, involves the use of a hard-coded cryptographic key in versions prior to 0.8.5 and 0.9.0-0.9.3. The flaw (CWE-321) allows network-based attackers to bypass authentication and authorization controls, potentially gaining full administrative access to network infrastructure without credentials. The CVSS 3.1 score of 9.8 reflects network exploitability with low complexity, no required privileges, and high impact across confidentiality, integrity, and availability. The vulnerability was disclosed through the Huntr bug bounty program and patched in February 2022. Organizations running affected versions should upgrade immediately to 0.8.5+, 0.9.4+, or 0.10.0+ as appropriate.

Vendor
gravitl
Product
gravitl/netmaker
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2022-02-18
Original CVE updated
2026-05-18
Advisory published
2022-02-18
Advisory updated
2026-05-18

Who should care

Organizations operating Netmaker-based virtual networks; security teams managing WireGuard infrastructure; DevOps engineers deploying network mesh solutions; compliance officers responsible for cryptographic key management controls

Technical summary

Netmaker versions prior to 0.8.5 and 0.9.4 embed a static cryptographic key within the application binary. This hard-coded key enables attackers to forge valid authentication tokens or decrypt sensitive communications, achieving unauthenticated administrative access to the Netmaker control plane. The vulnerability is exploitable remotely without credentials and grants complete control over virtual network configuration, peer management, and access policies.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Netmaker installations to version 0.8.5 or later (for 0.8.x track), 0.9.4 or later (for 0.9.x track), or 0.10.0/0.10.1 or later
  • Audit access logs for unauthorized administrative actions between deployment date and patch application
  • Rotate all Netmaker administrative credentials and API tokens following upgrade
  • Verify cryptographic key configuration uses environment variables or secure key management rather than compiled values
  • Review network segmentation to limit Netmaker server exposure to authorized administrative hosts only

Evidence notes

NVD CPE confirms vulnerable versions: all versions before 0.8.5, and 0.9.0 through 0.9.3. Huntr advisory documents exploitation path. GitHub commit 9bee126 provides patch verification.

Official resources

Disclosed 2022-02-18 via Huntr bug bounty program with coordinated patch release