Winstonprivacy Winston Firmware 1.5.4
Approved changes feed: RSS · Atom
cpe:2.3:o:winstonprivacy:winston_firmware:1.5.4:*:*:*:*:*:*:*part: o version: 1.5.4 update: *
| Vendor | Winstonprivacy (fec77824-9cf6-5b75-9a31-bdda36a6f46d) |
|---|---|
| Product | Winston Firmware (516db7d3-b2fa-5929-97ba-8e3bd64594af) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from NVD CPE 2.0 feed
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2020-16263 |
vulnerable | 2026-06-08 05:19:27.861005 |
Details available
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
Published: 2020-10-28T17:13:58.000Z
Updated: 2024-08-04T13:37:54.210Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16262 |
vulnerable | 2026-06-08 05:19:27.860554 |
Details available
Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.
Published: 2020-10-28T17:12:13.000Z
Updated: 2024-08-04T13:37:54.246Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16261 |
vulnerable | 2026-06-08 05:19:27.859852 |
Details available
Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.
Published: 2020-10-28T17:10:32.000Z
Updated: 2024-08-04T13:37:54.235Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16260 |
vulnerable | 2026-06-08 05:19:27.859531 |
Details available
Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.
Published: 2020-10-28T17:15:56.000Z
Updated: 2024-08-04T13:37:54.250Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16259 |
vulnerable | 2026-06-08 05:19:27.859077 |
Details available
Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.
Published: 2020-10-28T17:20:04.000Z
Updated: 2024-08-04T13:37:54.205Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16258 |
vulnerable | 2026-06-08 05:19:27.858618 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16257 |
vulnerable | 2026-06-08 05:19:27.858264 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2020-16256 |
vulnerable | 2026-06-08 05:19:27.857221 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.