CVE-2020-10754: fedoraproject fedora Improper Authentication
Vulnerability summary
CVE-2020-10754 is a medium (CVSS 4.3) Improper Authentication vulnerability in fedoraproject fedora. EPSS estimates a 0.99% chance of exploitation in the next 30 days, higher than 62.5% of scored vulnerabilities.
Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 08-06-2020PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
It was found that nmcli, a command line interface to NetworkManager did not honour 802-1x.ca-path and 802-1x.phase2-ca-path settings, when creating a new profile. When a user connects to a network using this profile, the authentication does not happen and the connection is made insecurely.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
EPSS trend
Probability
0.99%
Chance of exploitation in the next 30 days
Percentile
63%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.99% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-306Missing Authentication for Critical FunctionalityThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat29 products
- NetworkManager< 1:1.22.8-5.el8_2 | < 1:1.18.8-1.el7
- NetworkManager-adsl< 1:1.22.8-5.el8_2 | < 1:1.18.8-1.el7
- NetworkManager-adsl-debuginfo< 1:1.22.8-5.el8_2
- NetworkManager-bluetooth< 1:1.22.8-5.el8_2 | < 1:1.18.8-1.el7
- NetworkManager-bluetooth-debuginfo< 1:1.22.8-5.el8_2
Mageia4 products
- gnome-control-center< 3.32.1-2.2.mga7
- gnome-shell< 3.32.1-2.1.mga7
- networkmanager< 1.18.8-1.mga7
- networkmanager-applet< 1.8.24-1.mga7
[red hat]1 product
- networkmanager1.24.2
Debian1 product
- network-manager< 1.24.2-1
Fedoraproject1 product
- fedoraEOL31
Gnome1 product
- networkmanager< 1.22.14 | ≥ 1.24.0, < 1.24.2
6 vendors · 37 products
References
27 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10754X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
