CVE-2020-16259
CRITICALCVSS 9.8/10EPSS 1.73%
Last modified
CVE-2020-16259 is a critical-severity vulnerability rated 9.8/10 on the CVSS scale. Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.. EPSS estimates a 1.73% chance of exploitation in the next 30 days.
Description
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Winstonprivacy | Winston Firmware | 1.5.4 |
References
- https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4Exploit, Third Party Advisory
- https://winstonprivacy.com/Product
- https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4Exploit, Third Party Advisory
- https://winstonprivacy.com/Product
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2020-16259?
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
How severe is CVE-2020-16259?
CVE-2020-16259 has a CVSS score of 9.8/10 (CRITICAL severity). The EPSS model estimates a 1.73% probability of exploitation in the next 30 days.
How do I fix CVE-2020-16259?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2020
- CVE-2020-16253The PgHero gem through 2.6.0 for Ruby allows CSRF.8.1
- CVE-2020-16254The Chartkick gem through 3.3.2 for Ruby allows Cascading St…6.1
- CVE-2020-16255ownCloud (Core) before 10.5 allows XSS in login page 'forgot…6.1
- CVE-2020-16256The API on Winston 1.5.4 devices is vulnerable to CSRF.8.8
- CVE-2020-16257Winston 1.5.4 devices are vulnerable to command injection vi…9.8
- CVE-2020-16258Winston 1.5.4 devices make use of a Monit service (not manag…7.1
- CVE-2020-1626A vulnerability in Juniper Networks Junos OS Evolved may all…7.5
- CVE-2020-16260Winston 1.5.4 devices do not enforce authorization. This is …7.5
- CVE-2020-16261Winston 1.5.4 devices allow a U-Boot interrupt, resulting in…6.8
- CVE-2020-16262Winston 1.5.4 devices have a local www-data user that is ove…7.8
- CVE-2020-16263Winston 1.5.4 devices have a CORS configuration that trusts …9.1
- CVE-2020-16266An XSS issue was discovered in MantisBT before 2.24.2. Impro…5.4
Are you affected by CVE-2020-16259?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST