---
id: 4109
title: "Winston Privacy Version 1.5.4"
source_domain: bishopfox.com
source_url: "https://bishopfox.com/blog/winston-privacy-version-1-5-4-advisory"
published_at: "2020-10-27T00:00:00Z"
tags: ["advisory", "vpn", "csrf", "command-injection", "default-credentials", "iot-security", "winston-privacy"]
phying_url: "https://phying.com/item/4109"
lang: en
---

# Winston Privacy Version 1.5.4

## Summary

Nine vulnerabilities in the Winston Privacy device 1.5.4 — critical unauthenticated command injection, CSRF, CORS issues, default credentials, undocumented SSH — fixed in 1.5.8.

## Intelligence Metadata

- **Sources:** bishopfox.com
- **Published:** 2020-10-27T00:00:00Z
- **Original:** https://bishopfox.com/blog/winston-privacy-version-1-5-4-advisory
- **Phying News:** https://phying.com/item/4109