CVE-2020-1472 Zerologon Microsoft Advisory | Qualys
Summary: On September 11, 2020, a Dutch team known as Secura published an exploit showing how an unauthenticated remote user can take control of a domain controller and gain admin privileges through CVE-2020-1472, which received the maximum CVSS v3 score of 10.0. The flaw stems from weak encryption and authentication in the Netlogon protocol, where incorrect use of AES mode lets an attacker spoof any computer account's identity and replace its password with all zeroes, earning the name Zerologon.
Bottom line: Microsoft reported active attacks exploiting Zerologon by September 24, 2020, and a patch due in February 2021 would place domain controllers in enforcement mode - meaning unpatched or non-compliant devices would need explicit exceptions to keep authenticating.
Read the original at Qualys Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2020-1472
- Related
- CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021Microsoft Patch Tuesday, August 2020 Edition Cyber Risks ·