CVE-2020-14871
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H- packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.htmlThird Party AdvisoryVDB Entry
- packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.htmlExploitThird Party Advisory
- packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.htmlExploitThird Party Advisory
- packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.htmlExploitThird Party Advisory
- openwall.com/lists/oss-security/2021/03/03/1Mailing ListThird Party Advisory
- openwall.com/lists/oss-security/2024/07/03/3Mailing ListPatch
- oracle.com/security-alerts/cpuoct2020.htmlVendor Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14871US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1637 days
- CVSS
- 10.0 CRITICAL
- EPSS (30-day exploit probability)
- 80.2% · top 1% of all CVEs
- Weakness
- CWE-787
- Attack vector
- Network, remotely reachable
- Preconditions
- No privileges and no user interaction
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.