NetEase Cloud Music for Windows: Weak encryption of API responses
Summary
The Windows desktop client cloudmusic.exe decrypts responses from the /eapi/ and /xeapi/ API paths with a fixed AES-128-ECB key that is publicly documented and offers no integrity protection. An attacker who can intercept or originate server responses, for example on a hostile network, can create ciphertext the client accepts as genuine. The official record describes this as a prerequisite for further exploitation rather than a standalone compromise.
Affected
- NetEase Cloud Music for Windows 3.1.38
- NetEase Cloud Music for Windows 3.1.39.205426
- Default configuration: unaffected (per VulnCheck CNA record)
Fixed in
Unknown. No vendor fix version has been confirmed.
Workaround
- Monitor network traffic to NetEase Cloud Music /eapi/ and /xeapi/ endpoints. Blocking these may break the application.
- Remove the client where it is not business-required, or block it by policy.
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC assessment: exploitation none, automatable no, technical impact partial.
- Not listed in CISA KEV.
- Public proof-of-concept status is unverified.
Our recommendation
- Check whether cloudmusic.exe 3.1.38 or 3.1.39.205426 is installed on managed endpoints.
- Remove or block the application where it is not needed, especially on administrator workstations and unmanaged devices.
- Avoid using the client on public or untrusted Wi-Fi networks.
- Track the vendor for a fixed version and update as soon as one is available.
- Treat related CVE-2026-109422 and CVE-2026-109423 as part of the same risk and track their status together.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- VulnCheck advisory: NetEase Cloud Music Weak Encryption via eapi/xeapi www.vulncheck.com
- Vendor product page (NetEase) hr.163.com
- Public advisory gist (finder reference) gist.github.com
- OpenCVE: CVE-2026-109424 app.opencve.io
- Strix: CVE-2026-109424 www.strix.ai
- Vulners (Rapid7): CVE-2026-109424 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:37.
Original description (NVD)
NetEase Cloud Music client for Windows (cloudmusic.exe) versions 3.1.38 and 3.1.39.205426 contains a weak encryption vulnerability where /eapi/ and /xeapi/ API response bodies are decrypted using a fixed, publicly documented AES-128-ECB key with no integrity credential. Attackers who can intercept or originate server responses can construct valid ciphertext under the known key with PKCS#7 padding, enabling the client to accept forged API responses that serve as a prerequisite for further exploitation such as reaching the os.navigateExternal bridge.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.