Netease Cloud Music For Windows
Monthly
NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426 accept forged API responses because /eapi/ and /xeapi/ bodies are decrypted with a fixed AES-128-ECB key and no integrity credential. A network-positioned, unauthenticated attacker (MITM, rogue proxy, or spoofed DNS/ARP) can construct valid ciphertext with PKCS#7 padding, achieving high integrity impact (VI:H) on the client's data flow. The flaw alone only enables forged-response acceptance and requires chaining-such as to the os.navigateExternal bridge-for meaningful exploitation; no public exploit code or active exploitation has been identified at time of analysis.
TLS certificate validation bypass in NetEase Cloud Music for Windows 3.1.38 and 3.1.39.205426 lets a network-adjacent attacker who already holds a man-in-the-middle position present a rogue CA certificate, decrypt HTTPS traffic, and capture the MUSIC_U session credential for account takeover; in-transit response modification is also possible. The client validates neither the server certificate chain nor the hostname and does not consult the Windows certificate trust store, so no victim authentication or interaction beyond normal app use is required. The reported CVSS 4.0 base score is 9.1, but exploitation is constrained by the positional prerequisite (shared Wi-Fi, rogue AP, ARP spoofing, or compromised router), and no public exploit identified at time of analysis and no CISA KEV entry has been observed.
Remote code execution in NetEase Cloud Music for Windows 3.1.38 and 3.1.39.205426 allows an attacker with an active adversary-in-the-middle position to forge the /pc/upgrade/get upgrade-check response using a publicly known AES key over an unvalidated TLS connection, inject renderer content, and invoke the os.navigateExternal IPC bridge with a file:// URL to execute arbitrary local binaries under the logged-in user. The vendor CVSS 4.0 score is 9.2, and the independent assessment retains high confidentiality, integrity, and availability impact with no privileges or user interaction required, though AC:H reflects the network-position prerequisite; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.
NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426 accept forged API responses because /eapi/ and /xeapi/ bodies are decrypted with a fixed AES-128-ECB key and no integrity credential. A network-positioned, unauthenticated attacker (MITM, rogue proxy, or spoofed DNS/ARP) can construct valid ciphertext with PKCS#7 padding, achieving high integrity impact (VI:H) on the client's data flow. The flaw alone only enables forged-response acceptance and requires chaining-such as to the os.navigateExternal bridge-for meaningful exploitation; no public exploit code or active exploitation has been identified at time of analysis.
TLS certificate validation bypass in NetEase Cloud Music for Windows 3.1.38 and 3.1.39.205426 lets a network-adjacent attacker who already holds a man-in-the-middle position present a rogue CA certificate, decrypt HTTPS traffic, and capture the MUSIC_U session credential for account takeover; in-transit response modification is also possible. The client validates neither the server certificate chain nor the hostname and does not consult the Windows certificate trust store, so no victim authentication or interaction beyond normal app use is required. The reported CVSS 4.0 base score is 9.1, but exploitation is constrained by the positional prerequisite (shared Wi-Fi, rogue AP, ARP spoofing, or compromised router), and no public exploit identified at time of analysis and no CISA KEV entry has been observed.
Remote code execution in NetEase Cloud Music for Windows 3.1.38 and 3.1.39.205426 allows an attacker with an active adversary-in-the-middle position to forge the /pc/upgrade/get upgrade-check response using a publicly known AES key over an unvalidated TLS connection, inject renderer content, and invoke the os.navigateExternal IPC bridge with a file:// URL to execute arbitrary local binaries under the logged-in user. The vendor CVSS 4.0 score is 9.2, and the independent assessment retains high confidentiality, integrity, and availability impact with no privileges or user interaction required, though AC:H reflects the network-position prerequisite; no public exploit identified at time of analysis and no CISA KEV active exploitation is indicated.