CVE-2020-16257

Winston 1.5.4 devices are vulnerable to command injection via the API.