CVE-2020-0796KEV · OVERDUECWE-119

Microsoft SMBv3 Remote Code Execution Vulnerability

Critical · published March 12, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it critical at 10.0. It is confirmed in active exploitation. It sits in the 100.0th percentile for exploit probability.

1535
days past CISA
deadline
CVSS v3.1
10.0
EPSS
100%
Percentile
100.0
In the wild
Confirmed
What it is

🚨 A single malicious packet sent to an SMBv3 server can unleash chaos! This vulnerability can lead to remote code execution, making it an absolute game-changer for attackers! 🔥 Think of it like a sneaky thief slipping a fake delivery notice into your mailbox, tricking the delivery person into handing over the keys to your house. One crafty packet is all it takes to gain full access! If exploited, an attacker could execute arbitrary commands on the target system, potentially leading to complete control over the network. This means they could steal sensitive data, spread malware, or even shut down critical services — the sort of disaster that can be absolutely devastating for any organization!

Put simply

Think of it like a sneaky thief slipping a fake delivery notice into your mailbox, tricking the delivery person into handing over the keys to your house. One crafty packet is all it takes to gain full access! This vulnerability lies in how SMBv3 processes specific requests, allowing attackers to send specially crafted packets that can perform unauthorized actions. The flaw is particularly concerning because it doesn't require authentication, making it easy to exploit.

What to do

If exploited, an attacker could execute arbitrary commands on the target system, potentially leading to complete control over the network. This means they could steal sensitive data, spread malware, or even shut down critical services — the sort of disaster that can be absolutely devastating for any organization! To safeguard your systems, immediately apply the patches released by Microsoft. Ensure that your SMBv3 settings are configured correctly and consider disabling SMBv1 to further mitigate risks. Regularly audit your network for any suspicious activity as an added precaution. You've got this! By following these steps, you'll bolster your defenses and keep the cyber baddies at bay! 🛡️

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.99810 · 100.0th percentile
Weakness
CWE-119 · Improper Restriction of Operations within the Bounds of a Memory Buffer
Published
2020-03-12T20:15Z
KEV added
2022-02-10 · due 2022-08-10
Affected products (8)
ProductVersionsFixed in
microsoft/windows_10_1903all versions—
microsoft/windows_10_1903all versions—
microsoft/windows_10_1903all versions—
microsoft/windows_10_1909all versions—
microsoft/windows_10_1909all versions—
microsoft/windows_10_1909all versions—
microsoft/windows_server_1903all versions—
microsoft/windows_server_1909all versions—
References (15)
http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html · [email protected]http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html · [email protected]http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html · [email protected]http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html · [email protected]http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html · [email protected]http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html · [email protected]https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 · [email protected]http://packetstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.html · af854a3a-2127-422b-91ae-364da2661108http://packetstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.html · af854a3a-2127-422b-91ae-364da2661108https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796 · af854a3a-2127-422b-91ae-364da2661108https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 10 FEB 00:00Z
    Added to CISA KEV — remediate by Aug 10
    kev
  • 12 MAR 15:48Z
    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows…
    cvelistv5