CVE-2020-16263
CRITICALWinstonprivacy Winston Firmware - Exposure to Wrong Actor
Title source: ruleDescription
Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.
Scores
CVSS v3
9.1
EPSS
0.0031
EPSS Percentile
53.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Classification
CWE
CWE-668
Status
published
Affected Products (1)
winstonprivacy/winston_firmware
Timeline
Published
Oct 28, 2020
Tracked Since
Feb 18, 2026