PT-2020-14849 · Winston · Winston

Published 2020-10-28 · Updated 2020-11-04 · CVE-2020-16258

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions Winston version 1.5.4

Description The issue concerns the use of a Monit service in Winston devices, which is configured with default credentials and not managed during the normal user process.

Recommendations For Winston version 1.5.4, consider changing the default credentials of the Monit service to prevent unauthorized access. As a temporary workaround, restrict access to the Monit service until a more permanent solution is available.

Exploit

Fix

Using Hardcoded Credentials

Weakness Enumeration

CWE-798

Related Identifiers

CVE-2020-16258

Affected Products

Winston

References · 5

• 🔥 https://labs.bishopfox.com/advisories/winston-privacy-version-1.5.4 · Exploit
• https://osv.dev/vulnerability/CVE-2020-16258 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16258 · Security Note
• https://t.me/cvenotify/5121 · Telegram Post
• https://winstonprivacy.com · Note