CVE-2020-0796 Microsoft SMBv3 Remote Code Execution
Remote attackers can execute arbitrary code via crafted SMBv3 requests, affecting Windows 10 and Server systems.
- Exploited in the wild
- Since 10 Feb 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-0796?
CVE-2020-0796 is a critical memory corruption vulnerability in Microsoft Windows 10 Version 1903 for 32-bit Systems, published on 12 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Weakness: CWE-119
Which versions are affected by CVE-2020-0796?
It affects 4 products.
Products include Microsoft Windows 10 1903, Microsoft Windows 10 1909, Microsoft Windows Server 1903, Microsoft Windows Server 1909.
How do I fix CVE-2020-0796?
No fix has been published for CVE-2020-0796 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 10 Aug 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2020-0796 being exploited?
Yes. Attackers have exploited CVE-2020-0796 in the wild since at least 10 Feb 2022, including in ransomware campaigns.
Public exploit code: 2 Metasploit modules, 3 Exploit-DB entries, 1 Nuclei template and 86 proofs of concept on GitHub.
Sources
Also known as GHSA-vh23-87v3-h8c6.