High severity · published Jul 24, 2020
CVE-2020-15778
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument
7.4
CVSS
13.7%
EPSS
No
On KEV
Description
scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)13.7% · higher than 96% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AF
A700s Firmware · Netapp
All versions, or not specified · source: NVD
AI
Active IQ Unified Manager · Netapp
9.5 and later · source: NVD
FO
Fabric Operating System · Broadcom
All versions, or not specified · source: NVD
HC
Hci Compute Node · Netapp
All versions, or not specified · source: NVD
HM
Hci Management Node · Netapp
All versions, or not specified · source: NVD
HS
Hci Storage Node · Netapp
All versions, or not specified · source: NVD
OP
Openssh · Openbsd
before 8.3; 8.3; 8.3 · source: NVD, CISA
SO
Solidfire · Netapp
All versions, or not specified · source: NVD
SC
Steelstore Cloud Integrated Storage · Netapp
All versions, or not specified · source: NVD
SS
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5; V3.1.0 before V3.1.5 · source: CISA
SS
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · Siemens
V3.1.0 before V3.1.5 · source: CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-15778
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-15778
Third Party Advisory
https://access.redhat.com/errata/RHSA-2024:3166
Exploit
https://github.com/cpandya2909/CVE-2020-15778/
Third Party Advisory
https://news.ycombinator.com/item?id=25005567
Third Party Advisory
https://security.gentoo.org/glsa/202212-06
Third Party Advisory
https://security.netapp.com/advisory/ntap-20200731-0007/
Vendor Advisory
https://www.openssh.com/security.html
More from Fabric Operating System
7.8
CVE-2021-22555
Heap Out-Of-Bounds Write in Netfilter IP6T_SO_SET_REPLACE
6.7
CVE-2025-1976
Code injection exposure in Fabric OS 9.1.0 through 9.1.1d6
9.8
CVE-2026-87659
A critical authorization bypass vulnerability exists in the Management Server handling of Brocade Fabric OS versions before 10.0.1
9.8
CVE-2026-87684
A stack-based buffer overflow vulnerability exists in the SNMP daemon request handling of Brocade Fabric versions before 10.0.1
9.8
CVE-2023-3454
Remote code execution (RCE) vulnerability in Brocade Fabric OS after v9.0 and before v9.2.0 could allow an attacker to execute arbitrary code and use this to gain root access to…