PatchTheCVEwinston firmware vulnerabilities and fixes
Recent CVEs affecting winston firmware, with upgrade or downgrade steps. 8 tracked.
Also searched as: winstonfirmware.
winston firmware has 8 tracked vulnerabilities, 3 critical. A fixed release or vendor patch exists for 0. Most recent: 2020-10-28. Highest priority: CVE-2020-16257 (score 67/100).
- CVE-2020-16263 CRITICAL 9.1 MITIGATE Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins
- CVE-2020-16262 HIGH 7.8 MITIGATE Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege esca
- CVE-2020-16261 MEDIUM 6.8 MITIGATE Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
- CVE-2020-16260 HIGH 7.5 MITIGATE Winston 1.5.4 devices do not enforce authorization
- CVE-2020-16259 CRITICAL 9.8 MITIGATE Winston 1.5.4 devices have an SSH user account with access from bastion hosts
- CVE-2020-16258 HIGH 7.1 MITIGATE Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is config
- CVE-2020-16257 CRITICAL 9.8 MITIGATE Winston 1.5.4 devices are vulnerable to command injection via the API.
- CVE-2020-16256 HIGH 8.8 MITIGATE The API on Winston 1.5.4 devices is vulnerable to CSRF.
FAQ
How do I fix winston firmware vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is winston firmware being exploited right now?
None of the tracked winston firmware CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which winston firmware CVE should I patch first?
CVE-2020-16257 currently ranks highest (67/100): Winston 1.5.4 devices are vulnerable to command injection via the API..