{"id":"CVE-2020-14871","published":"2020-10-21T15:15:24Z","modified":"2026-06-17T02:55:43Z","title":"Oracle Solaris and Zettabyte File System (ZFS) Unspecified Vulnerability","vendor":"Oracle","product":"Solaris and Zettabyte File System (ZFS)","tier":"core","eol":null,"description":{"text":"Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).","provenance":"source","from":"NVD"},"summary":{"text":"Oracle Solaris (versions 10 and 11), specifically the Pluggable Authentication Module component, contains an unspecified flaw that is associated with the Solaris and ZFS product line. An unauthenticated attacker with network access over multiple protocols can exploit it without user interaction, and successful exploitation can lead to takeover of the affected Solaris system, with the note that Solaris 11.1 and later and ZFSSA 8.7 and later are not exploitable.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:08:18Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.80157,"percentile":0.99615,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2020-14871","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-09-04","exploitedFirstSeen":"2020-09-04","ransomware":false,"evidence":[{"url":"https://www.mandiant.com/resources/blog/critical-buffer-overflow-vulnerability-in-solaris-can-allow-remote-takeover","date":"2020-09-04"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"}],"references":[{"url":"http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/03/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/3","tags":["Mailing List","Patch"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.openwall.com/lists/oss-security/2021/03/03/1","tags":["Mailing List","Third Party Advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2024/07/03/3","tags":["Mailing List","Patch"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-14871","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Unauthenticated network attacker exploits exposed service","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols","start":160,"end":267}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Takeover implies privilege escalation to full control","mappingType":"primary_impact","evidence":[{"from":"description","quote":"Successful attacks of this vulnerability can result in takeover of Oracle Solaris","start":398,"end":479}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1499.004","name":"Application or System Exploitation","tactics":["impact"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Availability impact enables service disruption","mappingType":"primary_impact","evidence":[{"from":"description","quote":"CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts)","start":619,"end":697}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-7007","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7007","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[{"id":49261,"url":"https://www.exploit-db.com/exploits/49261","title":"Solaris SunSSH 11.0 x86 - libpam Remote Root","type":"remote","platform":"solaris","date":"2020-12-15","verified":false,"provenance":"source"},{"id":49896,"url":"https://www.exploit-db.com/exploits/49896","title":"Solaris SunSSH 11.0 x86 - libpam Remote Root (2)","type":"remote","platform":"solaris","date":"2021-05-21","verified":false,"provenance":"source"},{"id":50039,"url":"https://www.exploit-db.com/exploits/50039","title":"Solaris SunSSH 11.0 x86 - libpam Remote Root (3)","type":"remote","platform":"solaris","date":"2021-06-21","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2020-12-15"},"pocGithub":{"count":2,"skipped":0,"earliest":"2021-12-25","earliestUrl":"https://github.com/robidev/CVE-2020-14871-Exploit","repos":[{"name":"robidev/CVE-2020-14871-Exploit","url":"https://github.com/robidev/CVE-2020-14871-Exploit","stars":2,"created":"2021-12-25"},{"name":"FromPartsUnknown/EvilSunCheck","url":"https://github.com/FromPartsUnknown/EvilSunCheck","stars":0,"created":"2025-06-06"}]},"metasploit":[{"name":"Oracle Solaris SunSSH PAM parse_user_name() Buffer Overflow","module":"exploit/solaris/ssh/pam_username_bof","type":"exploit","disclosureDate":"2020-10-20","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/ssh/pam_username_bof.rb"}],"first":{"date":"2020-10-20","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/ssh/pam_username_bof.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-Remote-Root.html","http://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse_user_name-Buffer-Overflow.html","http://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root.html","http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Root.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1068","T1499.004"],"provenance":"ai"}],"timeline":[{"date":"2020-09-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.mandiant.com/resources/blog/critical-buffer-overflow-vulnerability-in-solaris-can-allow-remote-takeover","provenance":"source"},{"date":"2020-10-20","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2020-12-15, PoC-in-GitHub 2021-12-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/ssh/pam_username_bof.rb","provenance":"source"},{"date":"2020-10-21","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14871","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-7007","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":378},"priority":{"score":69.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2246 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 3 Exploit-DB entries; 1 NVD exploit link; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}