CVE-2020-16259

Опубликовано: 28 окт. 2020

Источник: nvd

CVSS3: 9.8

CVSS2: 10

EPSS Низкий

Описание

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.

Ссылки

https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
Exploit
Third Party Advisory
https://winstonprivacy.com/
Product
https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
Exploit
Third Party Advisory
https://winstonprivacy.com/
Product

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:o:winstonprivacy:winston_firmware:1.5.4:*:*:*:*:*:*:*

cpe:2.3:h:winstonprivacy:winston:-:*:*:*:*:*:*:*

EPSS

Процентиль: 60%

0.00398

Низкий

9.8 Critical

CVSS3

10 Critical

CVSS2

Дефекты

NVD-CWE-noinfo

Связанные уязвимости

GHSA-x7xx-38x8-pxv5

github

больше 3 лет назад