---
id: CVE-2020-13776
title: >-
  systemd through v245 mishandles numerical usernames such as ones composed of
  decimal digits or 0x followed by hex digits, as demonstrated by use of root
  privileges when privileges of the 0x0 user account were intended
summary: >-
  systemd through v245 mishandles numerical usernames such as ones composed of
  decimal digits or 0x followed by hex digits, as demonstrated by use of root
  privileges when privileges of the 0x0 user account were intended. NOTE: this
  issue e…
severity: medium
cvss: 6.7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-269
  - CWE-269
vendor: systemd_project
product: systemd
affected:
  - systemd <= 245
  - active_iq_unified_manager
  - solidfire_&_hci_management_node
  - fedora = 32
published: '2020-06-03'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T10:17:28.897'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-13776'
references:
  - url: 'https://github.com/systemd/systemd/issues/15985'
    label: cve@mitre.org
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/
    label: cve@mitre.org
  - url: 'https://security.netapp.com/advisory/ntap-20200611-0003/'
    label: cve@mitre.org
  - url: 'https://github.com/systemd/systemd/issues/15985'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IYGLFEKG45EYBJ7TPQMLWROWPTZBEU63/
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20200611-0003/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
epss: 0.00461
epssPercentile: 0.38182
ingestedAt: '2026-10-14T10:25:41.175Z'
---

## Overview

systemd through v245 mishandles numerical usernames such as ones composed of decimal digits or 0x followed by hex digits, as demonstrated by use of root privileges when privileges of the 0x0 user account were intended. NOTE: this issue exists because of an incomplete fix for CVE-2017-1000082.

## Affected

- `systemd <= 245`
- `active_iq_unified_manager`
- `solidfire_&_hci_management_node`
- `fedora = 32`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.