EXPOSURES › CVE-2020-1472
CVE-2020-1472
CRITICAL ⌖ ON CISA KEV · EXPLOITEDZerologon allowed attackers to gain domain administrator privileges without authentication, impacting virtually all Active Directory environments.
CVE-2020-1472, dubbed 'Zerologon,' exploited a flaw in Microsoft's Netlogon protocol, enabling privilege escalation and potential domain compromise. DIB organizations using Active Directory must immediately verify patching and mitigation measures to prevent unauthorized access and data exfiltration; failure to do so risks significant compliance violations and operational disruption.
Shame score — The vulnerability's ease of exploitation and widespread impact represent a catastrophic failure in Microsoft's security design and implementation, with potentially devastating consequences for DIB organizations.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.
"An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network."
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |