Microsoft Exchange Control Panel (ECP) Vulnerability CVE-2020-0688 Exploited
Summary: Microsoft released cumulative updates on February 11, 2020, fixing a remote code execution vulnerability (CVE-2020-0688) in Exchange 2010, 2013, 2016, and 2019, and Volexity began observing APT actors exploiting it in the wild shortly after the Zero Day Initiative published technical details. On March 4, 2020, Rapid7 released a Metasploit module for the exploit, and Volexity also observed APT groups brute-forcing credentials through Exchange Web Services at sharply increased frequency and intensity.
Key Takeaway: The exploit needs only a single compromised user credential or old service account to reach a significant internal asset, so organizations with 2FA on VPN and email can still be breached through an outdated or weak password - and Volexity notes it frequently works cases where old passwords led to serious data breaches.
Read the original at Volexity Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-0688
- Related
- CVE-2020-0688: Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, February 2020 Edition Cyber Risks ·Microsoft Patch Tuesday, March 2020 Edition Cyber Risks ·