CVE-2020-16259

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Oct 28, 2020
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2020

CVE-2020-16267.5A vulnerability in Juniper Networks Junos OS Evolved may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of specCVE-2020-162607.5Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities foCVE-2020-162616.8Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.CVE-2020-162627.8Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.CVE-2020-162639.1Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origiCVE-2020-162665.4An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitraCVE-2020-162678.8Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA moCVE-2020-162688.8The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via theCVE-2020-162695.5radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformedCVE-2020-16277.5A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service (DoS) by sending spCVE-2020-162706.1OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript paCVE-2020-162719.1The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to re
CVE-2020-16259: Critical severity, CVSS 9.8 | Vulnix