Microsoft · Windows
The flaw is an improper input validation issue in the Windows DNS Server component of Microsoft Windows, where the server fails to properly handle certain requests. An attacker who can reach the DNS server over the network can exploit this to execute code remotely, with no authentication or user interaction required and no particular configuration needed beyond the server being exposed.
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
First seen exploited 3 months after disclosure. Public exploit code (PoC-in-GitHub) was available 4 months before disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Network-reachable DNS server exploited remotely
remote code execution vulnerability exists in Windows Domain Name System servers
Attacker achieves arbitrary code execution on server
remote code execution vulnerability exists in Windows Domain Name System servers
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2020-1350 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
The Microsoft Windows domain name system (DNS) servers remote code execution (RCE) vulnerability, CVE-2020-1350, was disclosed in July 2020 and is still cycling through the initial priority indicators of observed underground activity.
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.