Skip to contentWinstonprivacy Winston Firmware vulnerabilities
- winstonprivacy winston firmwareWinston 1.5.4 devices have an SSH user account with access from bastion hosts. This is...CVE-2020-162599.8 Critical
- winstonprivacy winston firmwareWinston 1.5.4 devices make use of a Monit service (not managed during the normal user process)...CVE-2020-162587.1 High
- winstonprivacy winston firmwareWinston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and...CVE-2020-162607.5 High
- winstonprivacy winston firmwareWinston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows...CVE-2020-162639.1 Critical
- winstonprivacy winston firmwareWinston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root...CVE-2020-162627.8 High
- winstonprivacy winston firmwareWinston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.CVE-2020-162616.8 Medium
- winstonprivacy winston firmwareThe API on Winston 1.5.4 devices is vulnerable to CSRF.CVE-2020-162568.8 High
- winstonprivacy winston firmwareWinston 1.5.4 devices are vulnerable to command injection via the API.CVE-2020-162579.8 Critical