OpenClaw founder confirms in reply that 360 was the exclusive discoverer of the vulnerability.

PANews reported on March 22 that, according to Jinshi, the 360 ​​Security Cloud team received an official email from Peter, the founder of OpenClaw. In his reply, Peter officially confirmed the OpenClaw Gateway WebSocket unauthenticated upgrade vulnerability, which was exclusively discovered by the 360 ​​team.

Currently, 360 has simultaneously reported this high-risk vulnerability to the National Information Security Vulnerability Sharing Platform (CNVD) to assist the entire network in cutting off the source of the risk as soon as possible. The WebSocket unauthenticated upgrade vulnerability confirmed this time is a zero-day vulnerability. Attackers can use this vulnerability to silently bypass authorization authentication through WebSocket, gain control of the smart agent gateway, and may lead to the exhaustion of target system resources or complete crash.