CVE-2026-109424
Received Received - Intake

Weak Encryption in NetEase Cloud Music Windows Client

Publication date: 2026-10-12

Last updated on: 2026-10-12

Assigner: VulnCheck

Description
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-12
Last Modified
2026-10-12
Generated
2026-10-13
AI Q&A
2026-10-12
EPSS Evaluated
N/A
NVD
CVE-2026-109424
EUVD
EUVD-2026-97819

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
NetEase NetEase Cloud Music for Windows 3.1.38
NetEase NetEase Cloud Music for Windows 3.1.39.205426

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-321 The product uses a hard-coded, unchangeable cryptographic key.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves the NetEase Cloud Music Windows client using a hard-coded AES-128-ECB encryption key to decrypt API responses. The key is publicly known and lacks integrity checks, allowing attackers to forge valid encrypted responses. This could enable further attacks like accessing sensitive functions.

Detection Guidance

Detecting this vulnerability requires monitoring network traffic for API interactions with NetEase Cloud Music endpoints /eapi/ and /xeapi. Inspect encrypted responses for hard-coded AES-128-ECB key usage or PKCS#7 padding anomalies. Use packet capture tools like Wireshark to analyze traffic to cloudmusic.exe processes.

Impact Analysis

If exploited, attackers could intercept or manipulate API responses to trick the app into executing unauthorized actions, such as navigating to malicious external links via the os.navigateExternal bridge. This could lead to data theft or further compromise of the system.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR and HIPAA due to the lack of proper encryption and integrity checks in API responses. Weak encryption and hard-coded keys may lead to unauthorized data access or manipulation, which conflicts with GDPR's data protection principles and HIPAA's security requirements for safeguarding sensitive information.

Mitigation Strategies

Immediately update NetEase Cloud Music to the latest version beyond 3.1.39.205426. Block or monitor outbound connections to /eapi/ and /xeapi/ endpoints. Restrict network access to the application until patched. Consider disabling the os.navigateExternal bridge functionality if not required.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-109424. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart