What’s Vulnerable › Vulnerabilities

CVE-2020-37168: Ecommerce Systempay 1.0 Production Key Brute Force

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-13 · updated 2026-06-17
• Weakness: CWE-328

Description

Ecommerce Systempay 1.0 contains a weak cryptographic implementation vulnerability that allows attackers to brute force the 16-character production secret key used for payment signature generation. Attackers can extract payment form data and signatures from POST requests to the payment endpoint, then use SHA1 hash comparison to iteratively test key candidates until discovering the correct production key, enabling them to forge valid payment signatures and manipulate transaction amounts.

Affected products

• Paiement Ecommerce Systempay: 1.0

References

• https://paiement.systempay.fr/doc/fr-FR/
• https://paiement.systempay.fr/doc/fr-FR/module-de-paiement-gratuit/
• https://www.exploit-db.com/exploits/48017
• https://www.vulncheck.com/advisories/ecommerce-systempay-production-key-brute-force

Get alerted when CVE-2020-37168 or the next vulnerability affects your stack