$ cve CVE-2020-14871 JSON

CVE-2020-14871 KEV EXPLOIT

10.0

CRITICAL · CVSS 3.1 · EPSS 80.2% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2022-05-03.

Description

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Scoring

CVSS	10.0 (CRITICAL, v3.1)
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS	80.16% — more likely to be exploited than 100% of all CVEs
Weakness	CWE-787
On CISA KEV	yes — remediate by 2022-05-03
Public exploit	yes
Published	2020-10-21
Last modified	2026-06-17

CISA KEV

Name	Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
Added	2021-11-03
Due	2022-05-03
Vendor / product	Oracle / Solaris and Zettabyte File System (ZFS)
Ransomware use	none reported

Affected (1)

Vendor	Product
oracle	solaris

Public exploits

Source	Title	Date
exploit-db	Solaris SunSSH 11.0 x86 - libpam Remote Root (3)	2021-06-21
exploit-db	Solaris SunSSH 11.0 x86 - libpam Remote Root (2)	2021-05-21
exploit-db	Solaris SunSSH 11.0 x86 - libpam Remote Root	2020-12-15

References

→ the Explorer · watch your stack · NVD