Read the docs
TI-2020-12413 Aliases CVE-2020-15778GHSA-cvxm-8hgf-6m6m

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as…

Priority HIGH 69CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 2 fixed, 3 without a fix

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA and Red Hat. Impact type from CWE-78.

Summary

scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.13675 96th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Red Hat: 1 advisoryRed Hat: 2 fixed, 3 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 12

CPEVersionsRoleVendor
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*before 8.3VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:*8.3VulnerableOpenBSD
cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:*8.3 p1VulnerableOpenBSD
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:*not specified by NVDRunning onNetApp
cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*9.5VulnerableNetApp
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:* Versions before 8.3 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:* Versions 8.3 Vulnerable ·OpenBSD
  • cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:* Versions 8.3 p1 Vulnerable ·OpenBSD
  • cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:a700s:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
  • cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:* Versions 9.5 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 2 more CPE
CPEVersionsRoleVendor
cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*not specified by NVDVulnerableBroadcom
  • cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Broadcom

Remediation

Red Hat 1 advisory

  • RHSA-2024:3166 Released 2024-05-22 · Red Hat rating Moderate
    openssh security update
    • Red Hat Enterprise Linux AppStream (v. 8) openssh-askpass-8.0p1-24.el8
    • Red Hat Enterprise Linux BaseOS (v. 8) openssh-8.0p1-24.el8, openssh-cavs-8.0p1-24.el8, openssh-clients-8.0p1-24.el8 +4

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 5AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2024:3166
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2024:3166

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-15778
  2. 2026-10-03 Alias added: GHSA-cvxm-8hgf-6m6m

References

Exploit 1

Advisory 5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences