CVE-2020-14871

Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability

Published Oct 21, 2020 · updated Jun 16, 2026 · oracle solaris

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

Timeline

Detection, updates, and resolution for this record.

Oct 21, 2020 · Catalog
Detected
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Su
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Su

Required action

Apply updates per vendor instructions.

CISA due date May 3, 2022

Affected

cpe oracle/solarisversion unspecified
cpe oracle/solaris9
vendor Oracle Solaris and Zettabyte File System (ZFS)version unspecified

Sources

CISA KEVCVE-2020-14871
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
cisa.gov
CVE.orgCVE-2020-14871
Official CVE identifier
cve.org
FIRST EPSSCVE-2020-14871
30-day exploitation probability 80.2%
first.org
Exploit Database49261
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database49896
Public archive entry. The exploit body is not stored here.
exploit-db.com
Exploit Database50039
Public archive entry. The exploit body is not stored here.
exploit-db.com
Metasploit Modulesexploit_solaris/ssh/pam_username_bof
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com
NIST NVDCVE-2020-14871
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromis
nvd.nist.gov
Packet Storm Securityhttp://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html
Packet Storm link already published on the finding.
packetstormsecurity.com
Packet Storm Securityhttp://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com