Vulnerability Details : CVE-2020-0796

Public exploit exists!
Used for ransomware!
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Published 2020-03-12 16:15:16
Updated 2025-02-04 16:15:32
Source Microsoft Corporation
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2020-0796

CVE-2020-0796 is in the CISA Known Exploited Vulnerabilities Catalog

This issue is known to have been leveraged as part of a ransomware campaign.
CISA vulnerability name:
Microsoft SMBv3 Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2020-0796
Added on 2022-02-10 Action due date 2022-08-10

Exploit prediction scoring system (EPSS) score for CVE-2020-0796

EPSS FAQ
94.42%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2020-0796

  • SMBv3 Compression Buffer Overflow
    Disclosure Date: 2020-03-13
    First seen: 2021-05-21
    exploit/windows/smb/cve_2020_0796_smbghost
    A vulnerability exists within the Microsoft Server Message Block 3.1.1 (SMBv3) protocol that can be leveraged to execute code on a vulnerable server. This remove exploit implementation leverages this flaw to execute code in the context of the kernel, finally yielding a
  • SMBv3 Compression Buffer Overflow
    Disclosure Date: 2020-03-13
    First seen: 2020-04-26
    exploit/windows/local/cve_2020_0796_smbghost
    A vulnerability exists within the Microsoft Server Message Block 3.1.1 (SMBv3) protocol that can be leveraged to execute code on a vulnerable server. This local exploit implementation leverages this flaw to elevate itself before injecting a payload into winlogon.

CVSS scores for CVE-2020-0796

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.5
 HIGH AV:N/AC:L/Au:N/C:P/I:P/A:P
10.0
6.4
 NIST
10.0
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.9
6.0
 134c704f-9b21-4f2e-91b3-4a467353bcc0 2025-02-04
10.0
 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3.9
6.0
 NIST

CWE ids for CVE-2020-0796

  • The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
    Assigned by:
    • 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
    • nvd@nist.gov (Primary)

References for CVE-2020-0796

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close