Winston 1.5.4 devices have an SSH user account with access from bastion hosts. This is undocumented in device documents and is not announced to the user.

Published at: October 28, 2020 at 02:15PM
View on website

Winston 1.5.4 devices do not enforce authorization. This is exploitable from the intranet, and can be combined with other vulnerabilities for remote exploitation.

Published at: October 28, 2020 at 02:15PM
View on website

Winston 1.5.4 devices allow a U-Boot interrupt, resulting in local root access.

Published at: October 28, 2020 at 02:15PM
View on website

Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.

Published at: October 28, 2020 at 02:15PM
View on website

Winston 1.5.4 devices have a CORS configuration that trusts arbitrary origins. This allows requests to be made and viewed by arbitrary origins.

Published at: October 28, 2020 at 02:15PM
View on website