How severe is CVE-2020-5319?

CVE-2020-5319 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2020-5319 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-5319?

CVE-2020-5319 primarily affects Dell Emc Unity Operating Environment. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2020-5319?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

When was CVE-2020-5319 published?

CVE-2020-5319 was published on 2020-02-06 and last updated on 2026-06-17.

CVE-2020-5319

CVE-2020-5319 is a high-severity vulnerability in Dell Emc Unity Operating Environment with a CVSS 3.x base score of 7.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-129.

Key facts

Severity: High (CVSS 3.x base score 7.5)
CVSS v2: 7.8
EPSS exploit prediction: 1% (69th percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-129
Affected product: Dell Emc Unity Operating Environment
Published: 2020-02-06
Last modified: 2026-06-17

Description

Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that is used to provide SFTP service on a NAS server. A remote unauthenticated attacker may potentially exploit this vulnerability and cause a Denial of Service (Storage Processor Panic) by sending an out of order SSH protocol sequence.

Frequently asked questions

What is CVE-2020-5319?: Dell EMC Unity, Dell EMC Unity XT, and Dell EMC UnityVSA versions prior to 5.0.2.0.5.009 contain a Denial of Service vulnerability on NAS Server SSH implementation that is used to provide SFTP service on a NAS server. A remote unauthenticated attacker may potentially exploit this vulnerability and cause a Denial of Service (Storage Processor Panic) by sending an out of order SSH protocol sequence.
How severe is CVE-2020-5319?: CVE-2020-5319 has a CVSS 3.x base score of 7.5, rated high severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2020-5319 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (69th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-5319?: CVE-2020-5319 primarily affects Dell Emc Unity Operating Environment. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2020-5319?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
When was CVE-2020-5319 published?: CVE-2020-5319 was published on 2020-02-06 and last updated on 2026-06-17.

References

https://www.dell.com/support/security/en-us/details/540336/DSA-2020-019-Dell-EMC-Unity-Family-Dell-EMC-Unity-XT-Family-Denial-of-Service-Vulnerability

Affected products (3)

cpe:2.3:a:dell:emc_unity_operating_environment:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_unity_xt_operating_environment:*:*:*:*:*:*:*:*
cpe:2.3:a:dell:emc_unityvsa_operating_environment:*:*:*:*:*:*:*:*

More vulnerabilities in Dell Emc Unity Operating Environment

CVE-2021-36294 — Critical (CVSS 9.8): Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain an authentication bypass vulnerability. A remote…
CVE-2018-1183 — Critical (CVSS 9.8): In Dell EMC Unisphere for VMAX Virtual Appliance versions prior to 8.4.0.8, Dell EMC Solutions Enabler Virtual…
CVE-2021-36288 — High (CVSS 8.6): Dell VNX2 for File version 8.1.21.266 and earlier, contain a path traversal vulnerability which may lead…
CVE-2021-36289 — High (CVSS 7.8): Dell VNX2 OE for File versions 8.1.21.266 and earlier, contain a sensitive information disclosure vulnerability. A…
CVE-2019-3741 — High (CVSS 7.8): Dell EMC Unity and UnityVSA versions prior to 5.0.0.0.5.116 contain a plain-text password storage vulnerability. A…
CVE-2018-11064 — High (CVSS 7.8): Dell EMC Unity OE versions 4.3.0.x and 4.3.1.x and UnityVSA OE versions 4.3.0.x and 4.3.1.x contains an Incorrect File…

All CVEs affecting Dell Emc Unity Operating Environment →

Other CWE-129 (Improper Validation of Array Index) vulnerabilities

CVE-2020-27485 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2020-27483 — Critical (CVSS 9.9): Garmin Forerunner 235 before 8.20 is affected by: Array index error. The component is: ConnectIQ TVM. The attack vector…
CVE-2026-21413 — Critical (CVSS 9.8): A heap-based buffer overflow vulnerability exists in the lossless_jpeg_load_raw functionality of LibRaw Commit 0b56545…
CVE-2025-27034 — Critical (CVSS 9.8): Memory corruption while selecting the PLMN from SOR failed list.
CVE-2025-3357 — Critical (CVSS 9.8): IBM Tivoli Monitoring 6.3.0.7 through 6.3.0.7 Service Pack 19 could allow a remote attacker to execute arbitrary code…
CVE-2024-45569 — Critical (CVSS 9.8): Memory corruption while parsing the ML IE due to invalid frame content.

Browse all CWE-129 (Improper Validation of Array Index) vulnerabilities →