ZeroDay Findings
Sign inSign up

Findings

CVE-2020-15778

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument.

Published Jul 24, 2020 · updated Oct 14, 2026 · openbsd openssh

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 24, 2020 · NIST NVD

    Detected

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

  2. Oct 14, 2026 · NIST NVD

    Updated

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Affected

  • cpe netapp/a700s firmwareversion unspecified
  • cpe netapp/active iq unified managerversion unspecified
  • cpe netapp/hci management nodeversion unspecified
  • cpe netapp/solidfireversion unspecified
  • cpe netapp/steelstore cloud integrated storageversion unspecified
  • cpe openbsd/opensshversion unspecified
  • cpe openbsd/openssh8.3

Sources

  • CVE.orgVulnerability recordCVE-2020-15778

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2020-15778

    30-day exploitation probability 13.7%

    first.org
  • NIST NVDVulnerability recordCVE-2020-15778

    scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that

    nvd.nist.gov

References