PatchSiren

PatchSiren cyber security CVE debrief

CVE-2022-0664 gravitl CVE debrief

A critical vulnerability in Netmaker, a WireGuard-based virtual networking platform, involves the use of a hard-coded cryptographic key in versions prior to 0.8.5 and 0.9.0-0.9.3. The flaw (CWE-321) allows network-based attackers to bypass authentication and authorization controls, potentially gaining full administrative access to network infrastructure without credentials. The CVSS 3.1 score of 9.8 reflects network exploitability with low complexity, no required privileges, and high impact across confidentiality, integrity, and availability. The vulnerability was disclosed through the Huntr bug bounty program and patched in February 2022. Organizations running affected versions should upgrade immediately to 0.8.5+, 0.9.4+, or 0.10.0+ as appropriate.

Vendor
gravitl
Product
gravitl/netmaker
CVSS
CRITICAL 9.8
CISA KEV
Not listed in stored evidence
Original CVE published
2022-02-18
Original CVE updated
2026-05-18
Advisory published
2022-02-18
Advisory updated
2026-05-18

Who should care

Organizations operating Netmaker-based virtual networks; security teams managing WireGuard infrastructure; DevOps engineers deploying network mesh solutions; compliance officers responsible for cryptographic key management controls

Technical summary

Netmaker versions prior to 0.8.5 and 0.9.4 embed a static cryptographic key within the application binary. This hard-coded key enables attackers to forge valid authentication tokens or decrypt sensitive communications, achieving unauthenticated administrative access to the Netmaker control plane. The vulnerability is exploitable remotely without credentials and grants complete control over virtual network configuration, peer management, and access policies.

Defensive priority

critical

Recommended defensive actions

  • Upgrade Netmaker installations to version 0.8.5 or later (for 0.8.x track), 0.9.4 or later (for 0.9.x track), or 0.10.0/0.10.1 or later
  • Audit access logs for unauthorized administrative actions between deployment date and patch application
  • Rotate all Netmaker administrative credentials and API tokens following upgrade
  • Verify cryptographic key configuration uses environment variables or secure key management rather than compiled values
  • Review network segmentation to limit Netmaker server exposure to authorized administrative hosts only

Evidence notes

NVD CPE confirms vulnerable versions: all versions before 0.8.5, and 0.9.0 through 0.9.3. Huntr advisory documents exploitation path. GitHub commit 9bee126 provides patch verification.

Sources and references

Verified primary and authoritative sources

  • CVE-2022-0664 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2022-0664

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2022-0664 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2022-0664

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.