Vulnerability Report

CVE-2020-1472

CISA KEV Active

Title: Elevation of privilege via Netlogon secure channel (MS-NRPC)

Elevation of Privilege

Proof Of Concept

PoC Available for CVE-2020-1472

CWE Category NVD-CWE-noinfo
Published Date Aug 17, 2020
Modified Date Feb 23, 2026
Exploit Status Available
Score 5.5 CVSS v3.1
Exploit Probability (EPSS)
94.38%

Vulnerability Summary

CVE-2020-1472: An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An attacker who successfully exploited the vulnerability could run a specially crafted application on a device on the network. To exploit the vulnerability, an unauthenticated attacker would be required to use MS-NRPC to connect to a domain controller to obtain domain administrator access. Microsoft is addressing the vulnerability in a phased two-part rollout. These updates address the vulnerability by modifying how Netlogon handles the usage of Netlogon secure channels. For guidelines on how to manage the changes required for this vulnerability and more information on the phased rollout, see How to manage the changes in Netlogon secure channel connections associated with CVE-2020-1472 (updated September 28, 2020). When the second phase of Windows updates become available in Q1 2021, customers will be notified via a revision to this security vulnerability. If you wish to be notified when these updates are released, we recommend that you register for the security notifications mailer to be alerted of content changes to this advisory. See Microsoft Technical Security Notifications.

Impacted Vendors

N
netscape 1
S
samba 1
S
sgi 1
F
fedora 1
O
oracle 1
S
synology 1

Reference Links

http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html http://www.openwall.com/lists/oss-security/2020/09/17/2 https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 https://security.gentoo.org/glsa/202012-24 https://usn.ubuntu.com/4510-1/ https://usn.ubuntu.com/4510-2/ https://usn.ubuntu.com/4559-1/ https://www.kb.cert.org/vuls/id/490028 https://www.oracle.com/security-alerts/cpuApr2021.html https://www.synology.com/security/advisory/Synology_SA_20_21 http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html http://www.openwall.com/lists/oss-security/2020/09/17/2 https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/ https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472 https://security.gentoo.org/glsa/202012-24 https://usn.ubuntu.com/4510-1/ https://usn.ubuntu.com/4510-2/ https://usn.ubuntu.com/4559-1/ https://www.kb.cert.org/vuls/id/490028 https://www.oracle.com/security-alerts/cpuApr2021.html https://www.synology.com/security/advisory/Synology_SA_20_21 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472
CVSS v3.1
Source Entity [email protected]
Severity MEDIUM
5.5
Attack Vector
LOCAL
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
UNCHANGED
RAW VECTOR CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v3.1
Source Entity [email protected]
Severity CRITICAL
10.0
Attack Vector
NETWORK
Complexity
LOW
Privileges
N/A
Interaction
NONE
Confidentiality
N/A
Integrity
N/A
Availability
N/A
Scope
CHANGED
RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v2.0
Source Entity [email protected]
Severity HIGH
9.3
Access Vector
N/A
Authentication
N/A
RAW VECTOR AV:N/AC:M/Au:N/C:C/I:C/A:C

Associated Attack Patterns (CAPEC)

Total: Patterns

CVE-2020-1472 Exploits & PoCs (Proof Of Concept)

Exploit-DB https://www.exploit-db.com/exploits/49071
View Code
MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data updated via NVD.

MODIFIED

Vulnerability data or affected products updated.

PUBLISHED

Vulnerability first announced in NVD.

Attack Vector Matrix

Access Vector LOCAL
Complexity LOW
Privileges N/A
Interaction NONE
CVSS Vector String CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected Stack

No specific products linked.