← Back

Winstonprivacy

winstonprivacy

8 CVEs • 2 products

Products (2)

Click to collapse
Toggle
Winston Firmware
winston_firmware
8 CVEs
Winston
winston
0 CVEs

CVEs (8)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-16263
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
9.1 CRITICAL· v3
6.4 MEDIUM· v2
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
CVE-2020-16262
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
7.8 HIGH· v3
7.2 HIGH· v2
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
CVE-2020-16261
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
6.8 MEDIUM· v3
7.2 HIGH· v2
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
CVE-2020-16260
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
7.5 HIGH· v3
5.0 MEDIUM· v2
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
CVE-2020-16259
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
CVE-2020-16258
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
7.1 HIGH· v3
5.6 MEDIUM· v2
Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.
CVE-2020-16256
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
8.8 HIGH· v3
9.3 HIGH· v2
The API on Winston 1.5.4 devices is vulnerable to CSRF.
CVE-2020-16257
1Winstonprivacy
1Winston Firmware
Nov 21, 2024
Oct 28, 2020
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Winston 1.5.4 devices are vulnerable to command injection via the API.