{"id":"CVE-2020-1350","published":"2020-07-14T23:15:13Z","modified":"2026-06-17T03:01:10Z","title":"Microsoft Windows DNS Server Remote Code Execution Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an improper input validation issue in the Windows DNS Server component of Microsoft Windows, where the server fails to properly handle certain requests. An attacker who can reach the DNS server over the network can exploit this to execute code remotely, with no authentication or user interaction required and no particular configuration needed beyond the server being exposed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:07Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.96721,"percentile":0.99885,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"Reference CISA's ED 20-03 (https://www.cisa.gov/news-events/directives/ed-20-03-mitigate-windows-dns-server-remote-code-execution-vulnerability-july-2020-patch-tuesday) for further guidance and requirements. Note: The due date for addressing this vulnerability aligns with the requirements outlined in ED 20-03. https://nvd.nist.gov/vuln/detail/CVE-2020-1350","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-10-20","exploitedFirstSeen":"2020-10-20","ransomware":false,"evidence":[{"url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","date":"2020-10-20"},{"url":"https://media.defense.gov/2020/Oct/20/2002519884/-1/-1/0/CSA_CHINESE_EXPLOIT_VULNERABILITIES_UOO179811.PDF","date":"2020-10-20"},{"url":"https://us-cert.cisa.gov/ncas/alerts/aa20-275a","date":"2020-10-20"},{"url":"https://unit42.paloaltonetworks.com/network-attack-trends-winter-2020/","date":"2021-04-12"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"},{"url":"https://go.catonetworks.com/rs/245-RJK-441/images/Q2_24_Cato_CTRL_Threat_Report.pdf","date":"2024-08-13"},{"url":"https://www.zscaler.com/resources/industry-reports/non-web-attack-surface-report.pdf","date":"2025-10-20"}],"evidenceTotal":7,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-1350","tags":["US Government Resource"]}],"techniques":[{"id":"T1203","name":"Exploitation for Client Execution","tactics":["execution"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-reachable DNS server exploited remotely","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in Windows Domain Name System servers","start":2,"end":82}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Attacker achieves arbitrary code execution on server","mappingType":"primary_impact","evidence":[{"from":"description","quote":"remote code execution vulnerability exists in Windows Domain Name System servers","start":2,"end":82}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1587","name":"Develop Capabilities","tactics":["resource-development"],"provenance":"machine","basis":"dataset-annotation","bases":["dataset-annotation"],"basisDetail":"AnnoCTR expert entity-linking label (train split)","mappingType":null,"evidence":[{"reportId":"SRC-9411ade85d96fe0246ff","quote":"There is clear underground interest in CVE-2020-1350 based on threat actor posts seeking to develop code to leverage this vulnerability.","start":12822,"end":12958}],"confidence":"low","confidenceNote":"machine-matched from report text"}],"reports":[{"id":"SRC-9411ade85d96fe0246ff","title":"Prioritizing “critical” vulnerabilities: A threat intelligence perspective","publisher":"Intel 471","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-08-12_prioritizing-critical-vulnerabilities-a-threat.txt","date":"2020-08-12","mentions":[{"quote":"### CVE-2020-1350","start":11999,"end":12016},{"quote":"The Microsoft Windows domain name system (DNS) servers remote code execution (RCE) vulnerability, CVE-2020-1350, was disclosed in July 2020 and is still cycling through the initial priority indicators of observed underground activity.","start":12018,"end":12252},{"quote":"The criticality of the vulnerability, impacted vendor, type of vulnerability and widespread reporting of CVE-2020-1350 were indicators of its severity.","start":12427,"end":12578},{"quote":"There is clear underground interest in CVE-2020-1350 based on threat actor posts seeking to develop code to leverage this vulnerability.","start":12822,"end":12958},{"quote":"* Several threat actors posted information from open source reporting about CVE-2020-1350 and evidence of publicly available imitation PoC code was observed.","start":13481,"end":13638}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2020-12226","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12226","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":15,"skipped":0,"earliest":"2020-03-11","earliestUrl":"https://github.com/psc4re/NSE-scripts","repos":[{"name":"ZephrFish/CVE-2020-1350_HoneyPoC","url":"https://github.com/ZephrFish/CVE-2020-1350_HoneyPoC","stars":280,"created":"2020-07-14"},{"name":"maxpl0it/CVE-2020-1350-DoS","url":"https://github.com/maxpl0it/CVE-2020-1350-DoS","stars":237,"created":"2020-07-15"},{"name":"psc4re/NSE-scripts","url":"https://github.com/psc4re/NSE-scripts","stars":162,"created":"2020-03-11"},{"name":"captainGeech42/CVE-2020-1350","url":"https://github.com/captainGeech42/CVE-2020-1350","stars":18,"created":"2020-07-16"},{"name":"T13nn3s/CVE-2020-1350","url":"https://github.com/T13nn3s/CVE-2020-1350","stars":15,"created":"2020-07-15"}]},"first":{"date":"2020-03-11","source":"PoC-in-GitHub","url":"https://github.com/psc4re/NSE-scripts"},"provenance":"source"},"detections":{"cveRules":[{"title":"DNS RCE CVE-2020-1350","id":"b5281f31-f9cc-4d0d-95d0-45b91c45b487","level":"critical","status":"test","path":"rules-emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml","url":"https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2020/Exploits/CVE-2020-1350/proc_creation_win_exploit_cve_2020_1350.yml","techniques":["T1190","T1569.002"]}]},"exploitRefs":["http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html"],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"},{"stage":"related","techniques":["T1203"],"provenance":"source","lowConfidence":true},{"stage":"observed","techniques":["T1587"],"provenance":"machine","lowConfidence":true}],"timeline":[{"date":"2020-03-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/psc4re/NSE-scripts","provenance":"source"},{"date":"2020-07-14","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-1350","provenance":"source"},{"date":"2020-08-12","kind":"report","label":"Named in Intel 471: Prioritizing “critical” vulnerabilities: A threat intelligence perspective","url":"https://github.com/boschresearch/anno-ctr-lrec-coling-2024/blob/d510b6949e1938d47c93a43eedd562dc538439dc/AnnoCTR/text/train/intel471_2020-08-12_prioritizing-critical-vulnerabilities-a-threat.txt","provenance":"machine"},{"date":"2020-10-20","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cisa.gov/news-events/cybersecurity-advisories/aa20-275a","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2020-12226","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":477},"priority":{"score":73.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2201 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.98,"detail":"percentile 0.9989"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 15 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-20"}}