by Kastro
Paper/Archive/CVE-2020-0796

CVE-2020-0796

Microsoft Windows 10 Version 1903 for 32-bit Systems — Microsoft SMBv3 Remote Code Execution Vulnerability

KEV · due 10 Augransomware useEPSS 100%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (ADP, NVD agree)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.

Affected

ProductAffectedFixed inSource
Windows 10 Version 1903 for 32-bit Systemsunspecified–CNA
Windows 10 Version 1903 for x64-based Systemsunspecified–CNA
Windows 10 Version 1903 for ARM64-based Systemsunspecified–CNA
Windows Server, version 1903 (Server Core installation)unspecified–CNA
Windows 10 Version 1909 for 32-bit Systemsunspecified–CNA
Windows 10 Version 1909 for x64-based Systemsunspecified–CNA
Windows 10 Version 1909 for ARM64-based Systemsunspecified–CNA
Windows Server, version 1909 (Server Core installation)unspecified–CNA

Scores by source

CISA ADP10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refportal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796refpacketstormsecurity.com/files/156731/CoronaBlue-SMBGhost-Microsoft-Windows-10-SMB-3.1.1-Proof-Of-Concept.htmlrefpacketstormsecurity.com/files/156732/Microsoft-Windows-SMB-3.1.1-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/156980/Microsoft-Windows-10-SMB-3.1.1-Local-Privilege-Escalation.htmlrefpacketstormsecurity.com/files/157110/SMBv3-Compression-Buffer-Overflow.htmlrefpacketstormsecurity.com/files/157901/Microsoft-Windows-SMBGhost-Remote-Code-Execution.htmlrefpacketstormsecurity.com/files/158054/SMBleed-SMBGhost-Pre-Authentication-Remote-Code-Execution-Proof-Of-Concept.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0796kevcisa.gov/known-exploited-vulnerabilities-catalog