How severe is CVE-2020-8807?

CVE-2020-8807 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2020-8807 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2020-8807?

CVE-2020-8807 affects Electriccoin Zcashd. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2020-8807?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2020-8807 published?

CVE-2020-8807 was published on 2021-02-05 and last updated on 2026-06-17.

CVE-2020-8807

CVE-2020-8807 is a medium-severity vulnerability in Electriccoin Zcashd with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
CVSS v2: 5.0
EPSS exploit prediction: 1% (60th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Electriccoin Zcashd
Published: 2021-02-05
Last modified: 2026-06-17

Description

In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel.

Frequently asked questions

What is CVE-2020-8807?: In Electric Coin Company Zcashd before 2.1.1-1, the time offset between messages could be leveraged to obtain sensitive information about the relationship between a suspected victim's address and an IP address, aka a timing side channel.
How severe is CVE-2020-8807?: CVE-2020-8807 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2020-8807 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2020-8807?: CVE-2020-8807 affects Electriccoin Zcashd. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2020-8807?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2020-8807 published?: CVE-2020-8807 was published on 2021-02-05 and last updated on 2026-06-17.

References

https://electriccoin.co/blog/new-releases-2-1-1-and-hotfix-2-1-1-1/

Affected products (1)

cpe:2.3:a:electriccoin:zcashd:*:*:*:*:*:*:*:*

More vulnerabilities in Electriccoin Zcashd

CVE-2020-8806 — High (CVSS 7.5): Electric Coin Company Zcashd before 2.1.1-1 allows attackers to trigger consensus failure and double spending. A valid…

All CVEs affecting Electriccoin Zcashd →