CVE-2020-13776

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-06-03 · updated 2026-10-14
Weakness: CWE-269

Description

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Affected products

Fedoraproject Fedora: 32
Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows: all versions
NetApp Solidfire & Hci Management Node: all versions
systemd: through 245

References

https://github.com/systemd/systemd/issues/15985
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/
https://security.netapp.com/advisory/ntap-20200611-0003/
https://github.com/systemd/systemd/issues/15985
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/
https://security.netapp.com/advisory/ntap-20200611-0003/
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2020-13776 or the next vulnerability affects your stack