lin-snow Ech0 crypto.go MD5Encrypt risky encryption

published 2026-08-20 2 mo ago modified 2026-10-18 21 d ago also EUVD-2026-63578

cvss: 3.7; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.4%; EPSS 0.4% chance of exploitation in 30 days, percentile 30%
public exploits: 0; none known

A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 5.4.2 can resolve this issue. The patch is named 9ce19a3b0d0765086a655f45d3a706ec1810404f. It is recommended to upgrade the affected component.

Patch / fix

fixed in 1 links 3

lin-snow Ech0 5.4.2

github.com/lin-snow/Ech0@9ce19a3 commit
github.com/lin-snow/Ech0#315 pull request
github.com/lin-snow/Ech0/releases/tag/ech0-5.4.2 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 2 mo ago (2026-08-21)

Exploit prediction

0.37% chance of exploitation in the next 30 days, higher than 30% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
CNA	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
CNA	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C
CNA	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C
CNA	4.0	6.3	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CNA	3.1	3.7	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CNA	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N

Affected products

lin-snow Ech0

Classification

Weakness

CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CWE-310 Cryptographic Issues

References

github.com /lin-snow/Ech0/pull/315
issue-tracking, patch
github.com /lin-snow/Ech0/commit/9ce19a3b0d0765086a655f45d3a706ec1810404f
patch
github.com /lin-snow/Ech0/releases/tag/ech0-5.4.2
patch
vuldb.com /vuln/393736
vdb-entry, technical-description
vuldb.com /vuln/393736/cti
signature, permissions-required
vuldb.com /cve/CVE-2026-77151
third-party-advisory
vuldb.com /submit/881015
third-party-advisory
github.com /lin-snow/Ech0/issues/314
issue-tracking
github.com /lin-snow/Ech0/
product

Sources

CVE List CVE-2026-77151
NVD CVE-2026-77151

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary