CVE-2020-16259

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4Exploit, Third Party Advisory
https://winstonprivacy.com/Product
https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4Exploit, Third Party Advisory
https://winstonprivacy.com/Product

Timeline

Published: Oct 28, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-16267.5A vulnerability in Juniper Networks Junos OS Evolved may allow an attacker to cause a Denial of Service (DoS) by sending a high rate of spec CVE-2020-162607.5Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities fo CVE-2020-162616.8Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.CVE-2020-162627.8Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.CVE-2020-162639.1Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origi CVE-2020-162665.4An XSS issue was discovered in MantisBT before 2.24.2. Improper escaping on view_all_bug_page.php allows a remote attacker to inject arbitra CVE-2020-162678.8Zoho ManageEngine Applications Manager version 14740 and prior allows an authenticated SQL Injection via a crafted jsp request in the RCA mo CVE-2020-162688.8The MSI installer in 1E Client 4.1.0.267 and 5.0.0.745 allows remote authenticated users and local users to gain elevated privileges via the CVE-2020-162695.5radare2 4.5.0 misparses DWARF information in executable files, causing a segmentation fault in parse_typedef in type_dwarf.c via a malformed CVE-2020-16277.5A vulnerability in Juniper Networks Junos OS on vMX and MX150 devices may allow an attacker to cause a Denial of Service (DoS) by sending sp CVE-2020-162706.1OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript pa CVE-2020-162719.1The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 generates insufficiently random numbers, which allows remote attackers to re