ZeroDay Findings
Sign inSign up

Findings

CVE-2020-15778

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.

Published Jul 24, 2020 · updated Oct 14, 2026 · openbsd openssh

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Timeline

Detection, updates, and resolution for this record.

  1. Jul 24, 2020 · NIST NVD

    Detected

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

  2. Oct 14, 2026 · NIST NVD

    Updated

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Affected

  • cpe netapp/a700s firmwareversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/solidfireversion unspecified
  • cpe netapp/steelstore cloud integrated storageversion unspecified
  • cpe openbsd/opensshversion unspecified
  • cpe openbsd/openssh8.3

Sources

  • CVE.orgCVE-2020-15778

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-15778

    30-day exploitation probability 13.7%

    first.org
  • NIST NVDCVE-2020-15778

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that

    nvd.nist.gov

References