CVE-2020-16260: Winstonprivacy Winston Firmware

High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days.

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.

Affected products

Published 2020-10-28. Last modified 2026-06-17.