CVE-2020-24394

CVE-2020-24394 is a high-severity vulnerability in Oracle Sd-wan Edge with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-732.

Key facts

• Severity: High (CVSS 3.x base score 7.1)
• CVSS v2: 3.6
• EPSS exploit prediction: 0% (28th percentile)
• Actively exploited: Not listed in CISA KEV
• Weakness: CWE-732
• Affected product: Oracle Sd-wan Edge
• Published: 2020-08-19
• Last modified: 2026-06-17

Description

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

Frequently asked questions

What is CVE-2020-24394?

In the Linux kernel before 5.7.8, fs/nfsd/vfs.c (in the NFS server) can set incorrect permissions on new filesystem objects when the filesystem lacks ACL support, aka CID-22cf8419f131. This occurs because the current umask is not considered.

How severe is CVE-2020-24394?

CVE-2020-24394 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability none.

Is CVE-2020-24394 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-24394?

CVE-2020-24394 primarily affects Oracle Sd-wan Edge. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-24394?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2020-24394 published?

CVE-2020-24394 was published on 2020-08-19 and last updated on 2026-06-17.

References

• http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00007.html
• https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=962254
• https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.7.8
• https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=22cf8419f1319ff87ec759d0ebdff4cbafaee832
• https://security.netapp.com/advisory/ntap-20200904-0003/
• https://usn.ubuntu.com/4465-1/
• https://usn.ubuntu.com/4483-1/
• https://usn.ubuntu.com/4485-1/
• https://www.oracle.com/security-alerts/cpuApr2021.html
• https://www.starwindsoftware.com/security/sw-20210325-0004/

Affected products (13)

• cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
• cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
• cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
• cpe:2.3:a:oracle:sd-wan_edge:8.2:*:*:*:*:*:*:*
• cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12533:*:*:*:vsphere:*:*
• cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12658:*:*:*:vsphere:*:*
• cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build12859:*:*:*:vsphere:*:*
• cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13170:*:*:*:vsphere:*:*
• cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13586:*:*:*:vsphere:*:*
• cpe:2.3:a:starwindsoftware:starwind_virtual_san:v8:build13861:*:*:*:vsphere:*:*

More vulnerabilities in Oracle Sd-wan Edge

• CVE-2020-14606 — Critical (CVSS 10.0): Vulnerability in the Oracle SD-WAN Edge product of Oracle Communications Applications (component: User Interface).…
• CVE-2022-22965 — Critical (CVSS 9.8): A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data…
• CVE-2022-22963 — Critical (CVSS 9.8): In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is…
• CVE-2019-1010238 — Critical (CVSS 9.8): Gnome Pango 1.42 and later is affected by: Buffer Overflow. The impact is: The heap based buffer overflow can be used…
• CVE-2019-14821 — High (CVSS 8.8): An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM…
• CVE-2020-10543 — High (CVSS 8.2): Perl before 5.30.3 on 32-bit platforms allows a heap-based buffer overflow because nested regular expression…

All CVEs affecting Oracle Sd-wan Edge →

Other CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities

• CVE-2026-9508 — Critical (CVSS 10.0): Incorrect permission settings on a critical resource in Suprema BioStar 2 (versions 2.9.3 through 2.9.11) that allow…
• CVE-2025-14988 — Critical (CVSS 10.0): A security issue has been identified in ibaPDA that could allow unauthorized actions on the file system under certain…
• CVE-2025-69426 — Critical (CVSS 10.0): The Ruckus vRIoT IoT Controller firmware versions prior to 3.0.0.0 (GA) contain hardcoded credentials for an operating…
• CVE-2025-12004 — Critical (CVSS 10.0): Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown…
• CVE-2014-125121 — Critical (CVSS 10.0): Array Networks vAPV (version 8.3.2.17) and vxAG (version 9.2.0.34) appliances are affected by a privilege escalation…
• CVE-2025-46093 — Critical (CVSS 9.9): LiquidFiles before 4.1.2 supports FTP SITE CHMOD for mode 6777 (setuid and setgid), which allows FTPDrop users to…

Browse all CWE-732 (Incorrect Permission Assignment for Critical Resource) vulnerabilities →