CVE-2020-16259

PoC —

CVSS 3.1

9.8 critical

EPSS

2%p77

Published

Oct 28, 2020 (Oct 28, 2020)

Modified

Jun 17, 2026

Description

Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.

Vendors: winstonprivacy
Products: winston firmware
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.8%)

In the news0 stories

No ingested article mentions this CVE yet.