CVE-2020-16846 is a critical shell injection vulnerability affecting SaltStack Salt versions up to 3002, as well as distributions like Debian, Fedora, and openSUSE. This flaw allows unauthenticated attackers to execute arbitrary commands remotely by sending crafted web requests to the Salt API when the SSH client is enabled. With a CVSS score of 9.8 (Critical) and an EPSS score indicating high exploitability, this vulnerability poses a severe risk, enabling full compromise of confidentiality, integrity, and availability. It is actively exploited in the wild, with public Metasploit modules and Nuclei templates available, and has garnered significant community and media attention, including reports of its use in cryptomining campaigns.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 2015.8.10CPE matchmatch criteria | cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | ||
>= 2015.8.11, < 2015.8.13CPE matchmatch criteria | cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | ||
>= 2016.3.0, < 2016.3.4CPE matchmatch criteria | cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | ||
>= 2016.3.5, < 2016.3.6CPE matchmatch criteria | cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* | ||
>= 2016.3.7, < 2016.3.8CPE matchmatch criteria | cpe:2.3:a:saltstack:salt:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.