PatchTheCVE: winstonprivacyhttps://patchthecve.com/CVEs with upgrade or downgrade fix stepsCVE-2020-16263: Winston 1.5.4 devices have a CORS configuration that trusts arbitrary originshttps://patchthecve.com/cve/CVE-2020-16263.htmlhttps://patchthecve.com/cve/CVE-2020-16263.htmlWed, 17 Jun 2026 02:57:57 +0000CRITICAL 9.1: Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.CVE-2020-16262: Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escahttps://patchthecve.com/cve/CVE-2020-16262.htmlhttps://patchthecve.com/cve/CVE-2020-16262.htmlWed, 17 Jun 2026 02:57:57 +0000HIGH 7.8: Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.CVE-2020-16261: Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.https://patchthecve.com/cve/CVE-2020-16261.htmlhttps://patchthecve.com/cve/CVE-2020-16261.htmlWed, 17 Jun 2026 02:57:57 +0000MEDIUM 6.8: Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.CVE-2020-16260: Winston 1.5.4 devices do not enforce authorizationhttps://patchthecve.com/cve/CVE-2020-16260.htmlhttps://patchthecve.com/cve/CVE-2020-16260.htmlWed, 17 Jun 2026 02:57:57 +0000HIGH 7.5: Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.CVE-2020-16259: Winston 1.5.4 devices have an SSH user account with access from bastion hostshttps://patchthecve.com/cve/CVE-2020-16259.htmlhttps://patchthecve.com/cve/CVE-2020-16259.htmlWed, 17 Jun 2026 02:57:57 +0000CRITICAL 9.8: Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.CVE-2020-16258: Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is confighttps://patchthecve.com/cve/CVE-2020-16258.htmlhttps://patchthecve.com/cve/CVE-2020-16258.htmlWed, 17 Jun 2026 02:57:57 +0000HIGH 7.1: Winston 1.5.4 devices make use of a Monit service (not managed during the normal user process) which is configured with default credentials.CVE-2020-16256: The API on Winston 1.5.4 devices is vulnerable to CSRF.https://patchthecve.com/cve/CVE-2020-16256.htmlhttps://patchthecve.com/cve/CVE-2020-16256.htmlWed, 17 Jun 2026 02:57:57 +0000HIGH 8.8: The API on Winston 1.5.4 devices is vulnerable to CSRF.CVE-2020-16257: Winston 1.5.4 devices are vulnerable to command injection via the API.https://patchthecve.com/cve/CVE-2020-16257.htmlhttps://patchthecve.com/cve/CVE-2020-16257.htmlWed, 17 Jun 2026 02:57:57 +0000CRITICAL 9.8: Winston 1.5.4 devices are vulnerable to command injection via the API.