CVE-2020-36968: 
Monit vulnerability analysis and mitigation

CVE-2020-36968 is a password disclosure vulnerability in M/Monit 3.7.4 (by Tildeslash Ltd.) that allows authenticated attackers to retrieve MD5 password hashes for all users via administrative API endpoints. The vulnerability was published on January 28, 2026, and assigned by VulnCheck. It affects only M/Monit version 3.7.4. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (VulnCheck Advisory, Exploit-DB).

The root cause is classified as CWE-522 (Insufficiently Protected Credentials), where the M/Monit administrative API exposes MD5 password hashes without adequate access controls. Any authenticated user — regardless of privilege level — can send HTTP requests to the /api/1/admin/users/list and /api/1/admin/users/get endpoints to enumerate and extract MD5 hashes for all system users. The precondition for exploitation is simply possessing a valid (low-privileged) account on the M/Monit instance. A public proof-of-concept exploit is available on Exploit-DB (Exploit-DB, VulnCheck Advisory).

Successful exploitation results in a high confidentiality impact: an authenticated attacker can extract MD5 password hashes for every user account on the M/Monit instance. Because MD5 is a weak hashing algorithm, recovered hashes are susceptible to offline cracking, potentially enabling full account takeover for all users including administrators. There is no direct integrity or availability impact, but compromised credentials could facilitate lateral movement or privilege escalation within the monitored infrastructure (VulnCheck Advisory, Exploit-DB).

A public proof-of-concept exploit is available on Exploit-DB (EDB-49081), lowering the barrier for exploitation significantly (Exploit-DB). The vulnerability is detectable via Tenable Nessus plugin 297070. The EPSS score is approximately 0.128%, indicating a relatively low (but non-negligible) probability of exploitation in the wild. No confirmed in-the-wild exploitation, threat actor attribution, or CISA KEV catalog listing has been reported at this time (Tenable).

1. Reconnaissance: Identify internet-facing or network-accessible M/Monit 3.7.4 instances, typically running on port 8080 or 443, using tools like Shodan or Censys.
2. Obtain valid credentials: Acquire any valid low-privileged account on the target M/Monit instance (e.g., through phishing, credential stuffing, or default credentials).
3. Authenticate to the API: Send an HTTP POST or GET request to the M/Monit API with valid session credentials to establish an authenticated session.
4. Query the user list endpoint: Send an authenticated HTTP request to /api/1/admin/users/list to enumerate all user accounts on the system.
5. Extract password hashes: Send authenticated requests to /api/1/admin/users/get for individual users to retrieve their MD5 password hashes.
6. Crack the hashes offline: Use tools such as Hashcat or John the Ripper with wordlists or rainbow tables to crack the weak MD5 hashes and recover plaintext passwords.
7. Escalate or pivot: Use recovered administrator credentials to take full control of M/Monit and potentially pivot to monitored systems managed by the platform (Exploit-DB, VulnCheck Advisory).

• Network: Unusual or repeated authenticated HTTP requests to /api/1/admin/users/list or /api/1/admin/users/get endpoints from non-administrative user accounts or unexpected source IPs.
• Logs: M/Monit access logs showing low-privileged accounts querying administrative API endpoints; multiple sequential requests to user enumeration endpoints in a short timeframe.
• Behavioral: Authenticated sessions from accounts that do not normally access administrative functions; login attempts using newly cracked credentials from unexpected locations shortly after API enumeration activity.

Users should upgrade M/Monit to a version newer than 3.7.4 that addresses this vulnerability, as the vendor (Tildeslash Ltd.) has released updated versions (M/Monit). As an interim workaround, restrict network access to the M/Monit administrative interface using firewall rules or network segmentation to limit exposure to trusted hosts only. Additionally, enforce strong, unique passwords for all M/Monit accounts to reduce the risk of hash cracking, and consider migrating to a stronger password hashing algorithm if supported by the updated version (VulnCheck Advisory).

The vulnerability was assigned and disclosed by VulnCheck, with a corresponding advisory published on their platform. A technical write-up was also published by Infinit Security at infinitsec.net, providing additional context on the flaw. No significant vendor statements beyond the VulnCheck advisory or notable social media discussion has been identified at this time (VulnCheck Advisory, Infinit Security).