Weak MD5 Hash Usage in lin-snow Ech0

Executive Summary

CVE-2026-77151 is a security flaw in lin-snow Ech0 up to version 5.4.1 where user passwords are stored using unsalted MD5 hashing. The MD5Encrypt function in the crypto.go file applies MD5 without salt or iterative stretching, making passwords easily crackable. The vulnerability allows attackers with access to the database file to extract and crack password hashes, leading to potential account takeover.

Useful 0 Not Useful 0

Detection Guidance

Check if your Ech0 instance is running version 5.4.1 or earlier by inspecting the version or commit hash. Examine the SQLite database file (data/ech0.db) for the users table containing an unsalted MD5 password hash in the password column. Use tools like hashcat to test if passwords can be cracked from extracted hashes.

Useful 0 Not Useful 0

Impact Analysis

If an attacker gains access to the Ech0 database file, they can extract MD5 password hashes and crack them using tools like hashcat. This could lead to full account takeover, including administrative access, by authenticating via the login endpoint with cracked credentials. The SQLite database is stored as a single file, increasing exposure if backups or file serving are misconfigured.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Ech0 to version 5.4.2 or later immediately. The upgrade will migrate existing MD5 passwords to bcrypt automatically during the first login after update. Ensure no backups or database files are exposed to unauthorized access. Verify the migration completed by checking the user_local_auth table for bcrypt hashes.

Useful 0 Not Useful 0