CVE-2020-14871

Confirmed PUBLISHED

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected...

Oracle Corporation · Solaris Operating System

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

10.0 Critical

At a Glance

Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 10 and 11. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Solaris. While the vulnerability is in Oracle Solaris, attacks may significantly impact additional products. Successful attacks of this vulnerability can result in takeover of Oracle Solaris. Note: This CVE is not exploitable for Solaris 11.1 and later releases, and ZFSSA 8.7 and later releases, thus the CVSS Base Score is 0.0. CVSS 3.1 Base Score 10.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

metasploit cisa

CVE Published: Oct 21, 2020
Exploitation Reported: Nov 03, 2021
CVSS: 10.0 Critical
EPSS: —

Remote Low complexity No user interaction Unauthenticated

Affected Versions

Vendor	Product	Version	Status
oracle	solaris	10	Affected
oracle	solaris	11	Affected
Oracle Corporation	Solaris Operating System	10	Affected
Oracle Corporation	Solaris Operating System	11	Affected

CVE References

[oss-security] 20210302 Announce: OpenSSH 8.5 released openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2021/03/03/1
[oss-security] 20240703 Re: CVE-2024-6387: RCE in OpenSSH's server, on glibc-based Linux systems openwall.com · Mailing List http://www.openwall.com/lists/oss-security/2024/07/03/3
oracle.com/security-alerts/cpuoct2020.html oracle.com · CVE Record https://www.oracle.com/security-alerts/cpuoct2020.html
packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Remote-Ro... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/159961/SunSSH-Solaris-10-x86-Rem...
packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-libpam-... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/160510/Solaris-SunSSH-11.0-x86-l...

Show 2 more references

packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM-parse... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/160609/Oracle-Solaris-SunSSH-PAM...
packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remote-Root... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/163232/Solaris-SunSSH-11.0-Remot...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC

Scanner Artifacts

Nuclei and Metasploit references linked to this CVE.

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/ssh/pam_username_bof.rb	Apr 28, 2025

CVSS Scores

CVSS v3.1 10.0 Critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2021-12-25 21:27:59 UTC · GitHub

Weaknesses (CWE)

CWE-787

Out-of-bounds Write

Scanner Integrations

Scanner	Reference	Detected
Metasploit	https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/solaris/ssh/pam_username_bof.rb	Apr 28, 2025

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

robidev/CVE-2020-14871-Exploit

github · Created 2021-12-25 21:27:59 UTC · 2 stars

This is a basic ROP based exploit for CVE 2020-14871. CVE 2020-14871 is a vulnerability in Sun Solaris systems libpam library, and exploitable over ssh

pam_username_bof

metasploit · Created Unknown

Metasploit module for CVE-2020-14871

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-14871

{
  "cve_id": "CVE-2020-14871",
  "title": "Vulnerability in the Oracle Solaris product of Oracle Systems (component: Plu...",
  "affected_vendor": "Oracle Corporation",
  "affected_product": "Solaris Operating System",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 10.0,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-14871

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Scanner Artifacts

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Scanner Integrations

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API