Skip to content
Fencer Vulns
medium 6.7

CVE-2020-13776 json

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated b…

published 2020-06-03 6 y ago modified 2026-10-14 26 d ago also EUVD-2020-5993

cvss
6.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 40%
public exploits
0
none known

Summary

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

Patch / fix

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • systemd Debian 14, Debian 13, Debian 12 246-2

debian advisories DEBIAN-CVE-2020-13776

  • systemd RHEL 8 239-45.el8
  • systemd-pam RHEL 8 239-45.el8
  • systemd-libs RHEL 8 239-45.el8
  • systemd-udev RHEL 8 239-45.el8
  • systemd-tests RHEL 8 239-45.el8
  • systemd-container RHEL 8 239-45.el8
  • systemd-journal-remote RHEL 8 239-45.el8
  • systemd RHEL 8.2 EUS 239-31.el8_2.7

red hat advisories RHSA-2021:3900RHSA-2021:1611

  • systemd Rocky Linux 8 239-45.el8

rocky linux advisories RLSA-2021:1611

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-13776 updated cvss 6.7

systemd: Mishandles numerical usernames beginning with decimal digits or 0x followed by hexadecimal digits

  • Red Hat Enterprise Linux 7 systemd, libgudev1, systemd-libs, systemd-sysv, systemd-python, systemd-networkd, +2 more
    affected: workaround, no fix planned “Do not use `User=` directive in services with numerical usernames composed by decimal digits or starting with "0x" followed by hexadecimal digits (e.g. 0x[0-9A-Fa-f]+).”
  • Red Hat Enterprise Linux BaseOS (v. 8) systemd 239-45.el8, systemd-pam 239-45.el8, systemd-libs 239-45.el8, systemd-udev 239-45.el8, systemd-tests 239-45.el8, systemd-container 239-45.el8, +1 more
    fixed: vendor fix “Do not use `User=` directive in services with numerical usernames composed by decimal digits or starting with "0x" followed by hexadecimal digits (e.g. 0x[0-9A-Fa-f]+).” RHSA-2021:1611
  • Red Hat Enterprise Linux BaseOS EUS (v. 8.2) systemd 239-31.el8_2.7, systemd-pam 239-31.el8_2.7, systemd-libs 239-31.el8_2.7, systemd-udev 239-31.el8_2.7, systemd-tests 239-31.el8_2.7, systemd-container 239-31.el8_2.7, +1 more
    fixed: vendor fix “Do not use `User=` directive in services with numerical usernames composed by decimal digits or starting with "0x" followed by hexadecimal digits (e.g. 0x[0-9A-Fa-f]+).” RHSA-2021:3900
  • Red Hat OpenShift Container Platform 4 systemd, systemd-pam, systemd-libs, systemd-oomd, systemd-udev, systemd-tests, +7 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 6.7

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
17 mo ago

Exploit prediction

0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CISA ADP 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.2 AV:L/AC:H/Au:N/C:C/I:C/A:C

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-269 Improper Privilege Management

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.