CVE-2020-1350
Microsoft Windows DNS Server Remote Code Execution Vulnerability
Description
CVE-2020-1350, also known as SIGRed, is a critical-severity improper input validation vulnerability in Microsoft Windows DNS Server. Windows DNS Servers fail to properly handle requests, allowing an unauthenticated attacker to achieve remote code execution in the context of the Local System Account. With the maximum possible CVSS score of 10.0, this vulnerability represents one of the most severe threats to Windows Server environments. CISA has listed it in the Known Exploited Vulnerabilities (KEV) catalog, and with an EPSS score of 93.81% (99.9th percentile), exploitation is near-certain for exposed systems.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html(Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1350(US Government Resource)
Weakness Type
CWE-20: Improper Input Validation
Improper Input Validation occurs when software does not validate or incorrectly validates input that can affect the control flow or data flow of a program. In the case of Microsoft Windows DNS Server, the service fails to properly handle DNS requests, enabling a specially crafted DNS response to trigger a heap-based buffer overflow that leads to remote code execution.
Learn more: CWE-20 — Improper Input Validation
Impact Analysis
CVE-2020-1350 carries the maximum CVSS 3.1 score of 10.0 (CRITICAL), representing the highest possible severity rating. The vulnerability is remotely exploitable over the network with low attack complexity, requires no authentication, and needs no user interaction — making it trivially exploitable by any network-accessible attacker. Confidentiality (High): An attacker gains SYSTEM-level access to the DNS server, enabling access to all data on the server, Active Directory credentials, and potentially the entire domain. Integrity (High): With Local System privileges, the attacker can modify DNS records, install backdoors, manipulate domain configurations, and pivot to other systems. Availability (High): The attacker can completely disrupt DNS services, causing widespread network outages across the organization. The scope is changed, meaning successful exploitation of the DNS server can cascade to affect all systems dependent on DNS resolution, effectively compromising the entire network infrastructure.
Exploit Maturity
CVE-2020-1350 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog, and CISA issued Emergency Directive ED 20-03 specifically addressing this vulnerability. The EPSS score of 93.81% (99.9th percentile) indicates near-certain exploitation activity, placing it among the most actively targeted vulnerabilities. Public exploit code is available for CVE-2020-1350 via Packet Storm Security, which includes a denial-of-service proof-of-concept. The availability of public exploit code combined with the maximum CVSS score and wormable nature of this vulnerability makes it an extremely high-priority threat requiring immediate action.
Remediation
- Apply vendor security updates immediately as mandated by CISA Emergency Directive ED 20-03: Apply updates per vendor instructions. The remediation deadline was 2022-05-03.
- Update all affected Windows DNS Server installations — Windows Server 2008 (including R2), Windows Server 2012 (including R2), Windows Server 2016, and Windows Server 2019 — to the latest cumulative security patches.
- If immediate patching is not possible, apply the registry-based workaround to limit the size of DNS response packets: set the registry key
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\DNS\\Parameters\\TcpReceivePacketSizeto a DWORD value of0xFF00(65280) and restart the DNS service. - Implement network segmentation to restrict DNS server access, ensuring that only authorized systems can communicate with DNS servers on TCP/UDP port 53.
- Monitor DNS server logs for anomalous DNS response sizes and unusual SIG record queries, which may indicate exploitation attempts or reconnaissance activity.
Technical Details
CVE-2020-1350 is a critical improper input validation vulnerability (CWE-20) in the Windows DNS Server service (dns.exe). The flaw, dubbed SIGRed, exists in how the DNS server processes responses containing SIG resource records. When parsing a DNS response with a specially crafted SIG record exceeding 64KB, the DNS server triggers a heap-based buffer overflow. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the worst-case scenario: the vulnerability is network-exploitable without authentication, requires no user interaction, and has a changed scope. Because DNS is a fundamental network service, this vulnerability is considered wormable — an exploit could propagate automatically between DNS servers without user interaction. Code execution occurs in the context of the Local System Account, granting the attacker the highest possible privileges on the compromised server.
Frequently Asked Questions
Is CVE-2020-1350 being actively exploited?
Yes. CVE-2020-1350 (SIGRed) is listed in the CISA Known Exploited Vulnerabilities catalog, and CISA issued Emergency Directive ED 20-03 specifically for this vulnerability. The EPSS score of 93.81% (99.9th percentile) confirms near-certain exploitation. Public proof-of-concept exploit code is available.
What products are affected by CVE-2020-1350?
CVE-2020-1350 affects all versions of Microsoft Windows Server running the DNS Server role, including Windows Server 2008 (including R2), Windows Server 2012 (including R2), Windows Server 2016, and Windows Server 2019. The vulnerability has existed in Windows DNS for over 17 years.
How do I fix CVE-2020-1350?
Apply Microsoft's security updates for all affected Windows Server versions immediately. If patching is delayed, apply the registry-based workaround to limit TCP DNS packet sizes to 65280 bytes. Implement network segmentation to restrict access to DNS servers and monitor for anomalous DNS traffic.
How severe is CVE-2020-1350?
CVE-2020-1350 has the maximum CVSS 3.1 score of 10.0 (CRITICAL). Known as SIGRed, it is considered wormable and can be exploited remotely without authentication. It is one of the most critical Windows vulnerabilities ever disclosed and demands immediate remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.