CVE-2020-14871
Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability
Published Oct 21, 2020 · updated Jun 16, 2026 · oracle solaris
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Code
The project this record applies to. Exploit listings stay in References.
No public source repository is identified for this product.
Timeline
Detection, updates, and resolution for this record.
Oct 21, 2020 · Catalog
Detected
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Su
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
May 3, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Su
Required action
Apply updates per vendor instructions.
CISA due date May 3, 2022
Affected
- cpe oracle/solarisversion unspecified
- cpe oracle/solaris9
- vendor Oracle Solaris and Zettabyte File System (ZFS)version unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2020-14871
Oracle Solaris and Oracle ZFS Storage Appliance Kit contain an unspecified vulnerability causing high impacts to confidentiality, integrity, and availability of affected systems.
cisa.gov - CVE.orgVulnerability recordCVE-2020-14871
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-14871
30-day exploitation probability 80.2%
first.org - Exploit DatabasePublic exploit reference49261
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference49896
Public archive entry. The exploit body is not stored here.
exploit-db.com - Exploit DatabasePublic exploit reference50039
Public archive entry. The exploit body is not stored here.
exploit-db.com - Metasploit ModulesPublic exploit moduleexploit_solaris/ssh/pam_username_bof
Public module reference (normal). Module source is not copied into this catalog.
rapid7.com - NIST NVDVulnerability recordCVE-2020-14871
Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromis
nvd.nist.gov - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html
Packet Storm link already published on the finding.
packetstormsecurity.com - Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html
Packet Storm link already published on the finding.
packetstormsecurity.com