CVE-2020-16260

EUVD-2020-8221
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 42%
Affected Products (NVD)
VendorProductVersion
winstonprivacywinston_firmware
1.5.4
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
https://winstonprivacy.com/
https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4
https://winstonprivacy.com/