PatchTheCVECVE-2020-16260: Winston 1.5.4 devices do not enforce authorization
CVE-2020-16260 is a high-severity flaw (CVSS 7.5) affecting winston firmware. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | 7.5 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 0.9% (top 39%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2020-10-28 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2020-16260?
winston firmware: mitigate or apply the listed mitigation. Exact commands for each OS are on this page.
Is CVE-2020-16260 being exploited?
CVE-2020-16260 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2020-16260 affect?
CVE-2020-16260 affects winston firmware. Severity is high (CVSS 7.5). Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
How urgent is CVE-2020-16260?
Priority 51/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2020-16263 CRITICAL 9.1 MITIGATE Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins
- CVE-2020-16262 HIGH 7.8 MITIGATE Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege esca
- CVE-2020-16261 MEDIUM 6.8 MITIGATE Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
- CVE-2020-16259 CRITICAL 9.8 MITIGATE Winston 1.5.4 devices have an SSH user account with access from bastion hosts
- CVE-2020-16258 HIGH 7.1 MITIGATE Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is config