CVE-2020-16259 Hardcoded credentials in n/a
An undocumented SSH account allows unauthorized access from bastion hosts, enabling potential privilege escalation and data exposure.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-16259?
CVE-2020-16259 is a critical vulnerability in n/a, published on 28 Oct 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
Which versions are affected by CVE-2020-16259?
It affects 1 product.
Products include Winstonprivacy Winston Firmware.
How do I fix CVE-2020-16259?
No fix has been published for CVE-2020-16259 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-16259 being exploited?
There is no known exploitation of CVE-2020-16259 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2020-16257 Winston 1.5.4 devices are vulnerable to command injection via the API.
- CVE-2020-16263 Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins.
- CVE-2020-16256 The API on Winston 1.5.4 devices is vulnerable to CSRF.
- CVE-2020-16262 Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
- CVE-2020-16260 Winston 1.5.4 devices do not enforce authorization.
Sources
Also known as GHSA-x7xx-38x8-pxv5.