scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function, as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of "anomalous argument transfers" because that could "stand a great chance of breaking existing workflows."
Fix
Public exploits 4
- Neko-chanQwQ/CVE-2020-15778-Exploit PoC on GitHub
- cpandya2909/CVE-2020-15778 PoC on GitHub
- drackyjr/CVE-2020-15778-SCP-Command-Injection-Check PoC on GitHub
- yifanzhg/CVE-2020-15778 PoC on GitHub
Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.
Patch, vendor advisory and mitigation references on NVD 2
- https://www.openssh.com/security.html Vendor Advisory
- https://www.openssh.com/security.html Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.4 · openbsd, netapp, broadcomNVD modified 2026-10-14 10:17
Affected (CPE criteria) 11
cpe:2.3:a:openbsd:openssh:*:*:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:8.3:-:*:*:*:*:*:*cpe:2.3:a:openbsd:openssh:8.3:p1:*:*:*:*:*:*cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:active_iq_unified_manager:*:*:*:*:*:vmware_vsphere:*:*cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*cpe:2.3:o:broadcom:fabric_operating_system:-:*:*:*:*:*:*:*
References 13
- https://access.redhat.com/errata/RHSA-2024:3166 Third Party Advisory
- https://github.com/cpandya2909/CVE-2020-15778/ Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=25005567 Third Party Advisory
- https://security.gentoo.org/glsa/202212-06 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200731-0007/ Third Party Advisory
- https://www.openssh.com/security.html Vendor Advisory
- https://access.redhat.com/errata/RHSA-2024:3166 Third Party Advisory
- https://github.com/cpandya2909/CVE-2020-15778/ Exploit, Third Party Advisory
- https://news.ycombinator.com/item?id=25005567 Third Party Advisory
- https://security.gentoo.org/glsa/202212-06 Third Party Advisory
- https://security.netapp.com/advisory/ntap-20200731-0007/ Third Party Advisory
- https://www.openssh.com/security.html Vendor Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html