CVE-2020-1472
Microsoft Netlogon Privilege Escalation Vulnerability
Description
CVE-2020-1472, widely known as Zerologon, is a privilege escalation vulnerability in Microsoft's Netlogon Remote Protocol (MS-NRPC). The flaw allows an unauthenticated attacker who can establish a Netlogon secure channel connection to a domain controller to elevate privileges and obtain domain administrator access. This vulnerability is particularly dangerous because it enables complete domain compromise from a network-adjacent position. CISA has added CVE-2020-1472 to its Known Exploited Vulnerabilities catalog and issued Emergency Directive 20-04, confirming active exploitation in the wild. With an EPSS score of 94.38% (99.97th percentile) and confirmed ransomware usage, the Zerologon vulnerability represents one of the most critical threats to Windows Active Directory environments.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows server 1903 | All versions |
| microsoft | windows server 1909 | All versions |
| microsoft | windows server 2004 | - |
| microsoft | windows server 2008 | r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | - |
| microsoft | windows server 2019 | - |
| microsoft | windows server 20h2 | - |
| fedoraproject | fedora | 31; 32; 33 |
| opensuse | leap | 15.1; 15.2 |
| canonical | ubuntu linux | 14.04; 16.04; 18.04; 20.04 |
| synology | directory server | < 4.4.5-0101 |
| samba | samba | < 4.10.18; >= 4.11.0, < 4.11.13; >= 4.12.0, < 4.12.7 |
| debian | debian linux | 9.0 |
| oracle | zfs storage appliance kit | 8.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00080.html(Mailing List, Third Party Advisory)
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00086.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/159190/Zerologon-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/160127/Zerologon-Netlogon-Privilege-Escalation.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.openwall.com/lists/oss-security/2020/09/17/2(Mailing List, Third Party Advisory)
- https://lists.debian.org/debian-lts-announce/2020/11/msg00041.html(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H4OTFBL6YDVFH2TBJFJIE4FMHPJEEJK3/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ST6X3A2XXYMGD4INR26DQ4FP4QSM753B/(Mailing List, Third Party Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TAPQQZZAT4TG3XVRTAFV2Y3S7OAHFBUP/(Mailing List, Third Party Advisory)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472(Patch, Vendor Advisory)
- https://security.gentoo.org/glsa/202012-24(Third Party Advisory)
- https://usn.ubuntu.com/4510-1/(Third Party Advisory)
- https://usn.ubuntu.com/4510-2/(Third Party Advisory)
- https://usn.ubuntu.com/4559-1/(Third Party Advisory)
- https://www.kb.cert.org/vuls/id/490028(Third Party Advisory, US Government Resource)
- https://www.oracle.com/security-alerts/cpuApr2021.html(Patch, Third Party Advisory)
- https://www.synology.com/security/advisory/Synology_SA_20_21(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1472(US Government Resource)
Weakness Type
CWE-330: Use of Insufficiently Random Values
The Zerologon vulnerability stems from a cryptographic flaw in the Netlogon authentication protocol where the initialization vector (IV) is set to all zeros during the AES-CFB8 encryption process. This use of a static, non-random IV allows an attacker to forge authentication tokens by repeatedly attempting authentication with an all-zero client challenge, succeeding approximately once in every 256 attempts.
Learn more: CWE-330 — Use of Insufficiently Random Values
Impact Analysis
CVE-2020-1472 has been assessed with a CVSS 3.1 score of 5.5 (MEDIUM) by the vendor, though NVD rates it at 10.0 (CRITICAL) reflecting the true severity of complete domain compromise. The vulnerability requires local network access but has low attack complexity and requires no authentication or user interaction. Confidentiality (High): An attacker can gain full read access to all Active Directory objects, credentials, and sensitive data across the entire domain. The scope is unchanged per the vendor assessment, though the practical impact extends to every system in the domain. With an EPSS score of 94.38% and known ransomware usage, CVE-2020-1472 has one of the highest exploitation probabilities of any vulnerability, making it a top-priority remediation target for any organization running Windows domain controllers.
Exploit Maturity
Public exploit code is available for CVE-2020-1472 via Packet Storm Security, with additional proof-of-concept code available at Zerologon Proof of Concept. CISA has confirmed active exploitation in the wild through the KEV catalog and issued Emergency Directive 20-04 specifically for this vulnerability. The ransomware usage is confirmed as "Known," indicating that ransomware operators have integrated Zerologon into their attack toolkits for lateral movement and domain takeover. The EPSS score of 94.38% (99.97th percentile) indicates near-certain exploitation activity, placing this among the most actively exploited vulnerabilities tracked.
Remediation
- Apply vendor patches immediately as mandated by CISA Emergency Directive 20-04: Apply updates per vendor instructions. Microsoft addressed CVE-2020-1472 in a phased rollout, with the initial patch in August 2020 and enforcement mode enabled in February 2021.
- Verify that all domain controllers running Microsoft Windows Server (2008 R2, 2012, 2012 R2, 2016, 2019, 1903, 1909, 2004, 20H2) have been updated. Also update Samba installations (< 4.10.18, 4.11.x < 4.11.13, 4.12.x < 4.12.7), Synology Directory Server (< 4.4.5-0101), and other affected third-party implementations.
- Enable Netlogon secure channel enforcement mode on all domain controllers and monitor for Event IDs 5827, 5828, and 5829 that indicate non-compliant device connections attempting to use vulnerable Netlogon secure channels.
- Monitor domain controllers for indicators of compromise including unexpected password changes for computer accounts, anomalous Netlogon authentication patterns, and signs of credential dumping or lateral movement. Conduct Active Directory integrity checks.
- Implement network segmentation to restrict direct access to domain controllers from non-administrative networks, and deploy detection rules for Zerologon exploitation attempts in your SIEM and network monitoring tools.
Technical Details
CVE-2020-1472 exploits a fundamental cryptographic weakness in the Netlogon Remote Protocol (MS-NRPC) authentication handshake. The vulnerability arises because the ComputeNetlogonCredential function uses AES-CFB8 encryption with a static initialization vector of all zeros. When an attacker sends an authentication request with an all-zero client challenge and client credential, there is approximately a 1-in-256 chance that the server will accept the authentication due to the predictable encryption output. The CVSS vector string from the vendor (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) significantly understates the impact, while NVD's assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, score 10.0) better reflects the reality that an attacker can reset the domain controller's machine account password, enabling full domain compromise including credential extraction from NTDS.dit.
Frequently Asked Questions
Is CVE-2020-1472 being actively exploited?
Yes. CVE-2020-1472 (Zerologon) is one of the most actively exploited vulnerabilities, listed in the CISA KEV catalog with a dedicated Emergency Directive (ED 20-04). Ransomware operators are confirmed to use this vulnerability. The EPSS score of 94.38% (99.97th percentile) indicates near-certain exploitation.
What products are affected by CVE-2020-1472?
CVE-2020-1472 affects Microsoft Windows Server versions 2008 R2, 2012, 2012 R2, 2016, 2019, 1903, 1909, 2004, and 20H2. Third-party implementations of the Netlogon protocol are also affected, including Samba (< 4.10.18, 4.11.x < 4.11.13, 4.12.x < 4.12.7), Synology Directory Server, Fedora, openSUSE Leap, Ubuntu Linux, Debian Linux, and Oracle ZFS Storage Appliance Kit.
How do I fix CVE-2020-1472?
Apply the Microsoft security updates and enable Netlogon secure channel enforcement mode on all domain controllers. Update all affected third-party implementations including Samba. Monitor for Event IDs 5827-5829 to identify non-compliant devices, and restrict network access to domain controllers.
How severe is CVE-2020-1472?
CVE-2020-1472 is considered one of the most severe vulnerabilities in Active Directory environments. While the vendor CVSS score is 5.5 (MEDIUM), NVD rates it 10.0 (CRITICAL). The vulnerability enables complete domain takeover from an unauthenticated network position, with confirmed ransomware usage.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.