← Back to browse · API

CVE-2020-1472

Severity
MEDIUM
CVSS
5.5
EPSS
0.99512
Risk score
81.83
CISA KEV
Yes
PoC
No
Published
2021-11-03
Modified
2021-11-03
First seen
2026-08-07
Aliases
EUVD-2020-12346, GHSA-GC5H-XF3G-H5X4
Products
Microsoft:Netlogon, Microsoft:Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.0.0 <publication, Microsoft:Windows Server 2008 R2 Service Pack 1 6.1.0 <publication, Microsoft:Windows Server 2012 (Server Core installation) 6.2.0 <publication, Microsoft:Windows Server 2012 6.2.0 <publication, Microsoft:Windows Server 2012 R2 (Server Core installation) 6.3.0 <publication, Microsoft:Windows Server 2012 R2 6.3.0 <publication, Microsoft:Windows Server 2016 (Server Core installation) 10.0.0 <publication, Microsoft:Windows Server 2016 10.0.0 <publication, Microsoft:Windows Server 2019 (Server Core installation) 10.0.0 <publication, Microsoft:Windows Server 2019 10.0.0 <publication, Microsoft:Windows Server version 2004 10.0.0 <publication, Microsoft:Windows Server version 20H2 10.0.0 <publication, Microsoft:Windows Server, version 1903 (Server Core installation) 10.0.0 <publication, Microsoft:Windows Server, version 1909 (Server Core installation) 10.0.0 <publication
Sources
euvd EUVD-2020-12346
cisa.gov CVE-2020-1472

Description

Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.

References