How severe is CVE-2020-12769?

CVE-2020-12769 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2020-12769 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-12769?

CVE-2020-12769 primarily affects Netapp Active Iq Unified Manager. In total, 25 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-12769?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-12769 published?

CVE-2020-12769 was published on 2020-05-09 and last updated on 2026-06-17.

CVE-2020-12769

CVE-2020-12769 is a medium-severity vulnerability in Netapp Active Iq Unified Manager with a CVSS 3.x base score of 5.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-662.

Key facts

Severity: Medium (CVSS 3.x base score 5.5)
CVSS v2: 4.9
EPSS exploit prediction: 1% (47th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-662
Affected product: Netapp Active Iq Unified Manager
Published: 2020-05-09
Last modified: 2026-06-17

Description

An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.

Frequently asked questions

What is CVE-2020-12769?: An issue was discovered in the Linux kernel before 5.4.17. drivers/spi/spi-dw.c allows attackers to cause a panic via concurrent calls to dw_spi_irq and dw_spi_transfer_one, aka CID-19b61392c5a8.
How severe is CVE-2020-12769?: CVE-2020-12769 has a CVSS 3.x base score of 5.5, rated medium severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2020-12769 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-12769?: CVE-2020-12769 primarily affects Netapp Active Iq Unified Manager. In total, 25 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-12769?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-12769 published?: CVE-2020-12769 was published on 2020-05-09 and last updated on 2026-06-17.

References

Affected products (25)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:hci_compute_node_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:a700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h610s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h615c_firmware:-:*:*:*:*:*:*:*

More vulnerabilities in Netapp Active Iq Unified Manager

CVE-2021-44228 — Critical (CVSS 10.0): Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in…
CVE-2024-52533 — Critical (CVSS 9.8): gio/gsocks4aproxy.c in GNOME GLib before 2.82.1 has an off-by-one error and resultant buffer overflow because…
CVE-2023-38545 — Critical (CVSS 9.8): This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the…
CVE-2021-32292 — Critical (CVSS 9.8): An issue was discovered in json-c from 20200420 (post 0.14 unreleased code) through 0.15-20200726. A…
CVE-2022-31692 — Critical (CVSS 9.8): Spring Security, versions 5.7 prior to 5.7.5 and 5.6 prior to 5.6.9 could be susceptible to authorization rules bypass…
CVE-2022-2526 — Critical (CVSS 9.8): A use-after-free vulnerability was found in systemd. This issue occurs due to the on_stream_io() function and…

All CVEs affecting Netapp Active Iq Unified Manager →

Other CWE-662 vulnerabilities

CVE-2018-15555 — Critical (CVSS 9.8): On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and…
CVE-2024-32644 — Critical (CVSS 9.1): Evmos is a scalable, high-throughput Proof-of-Stake EVM blockchain that is fully compatible and interoperable with…
CVE-2026-53277 — High (CVSS 8.8): In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Take the SRCU lock for page table…
CVE-2022-23005 — High (CVSS 8.7): Western Digital has identified a weakness in the UFS standard that could result in a security vulnerability. This…
CVE-2016-8368 — High (CVSS 8.6): An issue was discovered in Mitsubishi Electric Automation MELSEC-Q series Ethernet interface modules QJ71E71-100, all…
CVE-2022-1931 — High (CVSS 8.1): Incorrect Synchronization in GitHub repository polonel/trudesk prior to 1.2.3.

Browse all CWE-662 vulnerabilities →