CyberRota Analysis
AI-GeneratedEch0 versions prior to 4.4.3 are vulnerable due to insufficient authorization checks on system log endpoints, enabling any authenticated non-admin user to access and stream all server logs. This flaw allows attackers to gather sensitive reconnaissance data, such as internal file paths and error stack traces, which could facilitate further exploitation. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized data exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers can access historical logs and real-time log streams via GET /api/system/logs, GET /api/system/logs/stream, and WS /ws/system/logs to gather reconnaissance data including internal file paths, error stack traces, and application state.