lin-snow Ech0 crypto.go MD5Encrypt risky encryption
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-327.
Summary
A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 5.4.2 can resolve this issue. The patch is named 9ce19a3b0d0765086a655f45d3a706ec1810404f. It is recommended to upgrade the affected component.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| lin-snow | Ech0 | 5.4.0; 5.4.1 | 5.4.2 | Patch available | CNA |
- Ech0 Vendorlin-snow Affected 5.4.0; 5.4.1 Fixed in 5.4.2 Patch available CNA
CPE names CNA · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:lin-snow:ech0:*:*:*:*:*:*:*:* | — | — | — |
- cpe:2.3:a:lin-snow:ech0:*:*:*:*:*:*:*:* Versions — — ·—
Remediation
- Fix · CNA Ech0 (lin-snow) Fixed in 5.4.2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-77151
- 2026-10-03 Alias added: GHSA-m3r5-hc33-p4wf
References
More lin-snow vulnerabilities
- TI-2026-55162 Ech0 before 4.7.3 Access Token Revocation Bypass CVSS 4.0CRITICAL 9.1
- TI-2026-55163 Ech0 before 4.5.1 Authorization Bypass via Session Tokens CVSS 4.0HIGH 8.7
- TI-2026-55160 Ech0 before 4.7.3 OAuth Redirect URI Validation Bypass CVSS 4.0HIGH 8.8
- TI-2026-27239 Ech0 Affected by Unauthenticated Server-Side Request Forgery in Website Preview Feature CVSS 3.1HIGH 7.5
- TI-2026-27240 Ech0 affected by unauthenticated SSRF in GetWebsiteTitle allows access to internal services and cloud metadata CVSS 3.1HIGH 7.2
- TI-2026-55159 Ech0 before 4.7.3 Unauthenticated fav_count Modification CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-77151 · CVE Program
- CVE-2026-77151 · NVD
- FIRST EPSS
- GHSA-m3r5-hc33-p4wf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences