Winston 1.5.4 devices have a local www-data user that is overly permissioned, resulting in root privilege escalation.

Published Oct 28, 2020 · Updated Aug 4, 2024 · Assigned by mitre