CVSS 3.1
10.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HCVE-2020-1350
Critical (10.0) in Microsoft Windows. In CISA KEV since 2021-11-03. EPSS 97% chance of exploitation in the next 30 days.
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
Severity
- EPSS
- 97% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-11-01)
- CISA KEV
- listed 2021-11-03, due 2022-05-03
- CWE
- CWE-20
- Published
- Modified
- Record from
- the NVD, synced
Affected
- microsoft:windows_server_2008
- microsoft:windows_server_2012
- microsoft:windows_server_2016
- microsoft:windows_server_2019
References
- http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350
- http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1350