lin-snow Ech0 CVE-2026-77151

Exploitation requires prior read access to the Ech0 database (SQLite file or raw database query capability) obtained through a separate vulnerability or misconfiguration - this CVE does not provide that access on its own. The specific condition is that passwords were stored by the MD5Encrypt function as bare, unsalted MD5 digests (confirmed by migration source code comment '历史裸 MD5'), making them vulnerable to offline dictionary and rainbow-table attacks once extracted. Limiting factors: the attacker must independently breach database confidentiality before this weakness is relevant; CVSS AC:H encodes this chained prerequisite; accounts using long, unique, randomly generated passwords offer significantly higher resistance to offline cracking even against unsalted MD5; and fresh Ech0 installations (no legacy password column) are unaffected by the backfill migration entirely.

The CVSS 4.0 score of 6.3 (AV:N/AC:H/PR:N/UI:N/VC:L) accurately reflects the chained nature of this vulnerability: an attacker cannot exploit the weak hash directly over the network; they must first obtain the hash values through a secondary vector such as database file exposure, path traversal, or backup leak. AC:H encodes this prerequisite correctly. Once hashes are obtained, offline cracking of unsalted MD5 is highly practical - common passwords fall within seconds using precomputed rainbow tables or GPU hashcat runs. The confidentiality impact (VC:L) is arguably conservative: successful cracking yields plaintext credentials that enable full account takeover, though the 'L' rating reflects that not all hashes are easily crackable. No EPSS data was provided in the input. KEV status is absent and no active exploitation has been reported, placing this firmly in the 'patch on schedule' tier absent evidence of a co-occurring data-access breach. For deployments that have already suffered a database compromise, this weakness materially amplifies credential exposure risk.

An attacker who obtains the Ech0 SQLite database file - for instance through a misconfigured web server exposing the data directory, a separate path traversal vulnerability, or an exfiltrated backup - extracts the users.password column containing unsalted MD5 hashes and submits them to an offline hashcat session against a common wordlist or precomputed rainbow table. Because no per-user salt was applied, a single table lookup cracks matching hashes across all accounts simultaneously. No public proof-of-concept exploit targeting this specific CVE exists; the chained database-access prerequisite is the primary barrier.