Microsoft · Exchange Server
The Microsoft Exchange Server vulnerability is a remote code execution flaw in the Exchange software, where it fails to properly handle objects in memory, which leads to memory corruption. An attacker with network access and low-privileged authentication can exploit it without any user interaction to run code, with high impact to confidentiality, integrity and availability.
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
First seen exploited 28 days after disclosure. Public exploit code (Metasploit) was available the same day.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
CVE-2020-0688 is a RCE vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory. A nation-state APT actor has been observed exploiting this vulnerability to conduct widespread, distributed, and anonymized brute force access attempts against hundreds of government and private sector targets worldwide.
T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020- 0688 .
CVE-2020-0688 is a remote code execution vulnerability exists in Microsoft Exchange Server. CISA has observed the actors exploiting CVE-2020-0688 for remote code execution to enable email collection of targeted networks. Also, Threat actors used credentials in conjunction with known vulnerabilities on public-facing applications, such as virtual private networks (VPNs)—CVE-2020-0688 and CVE-2020-17144—to escalate privileges and gain remote code execution (RCE) on the exposed applications.
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2020-0688 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Within weeks of public disclosure of CVE-2020-0688, CISA analysts identified traffic that was indicative of Chinese MSS-affiliated threat actors attempting to exploit this vulnerability using the Collection [TA0009] technique listed in table 10.
4 passages name itOriginal (opens in a new tab) ↗
T1190 Exploit Public-Facing Application Gelsemium exploits the vulnerability CVE-2020-0688 .
2 passages name itOriginal (opens in a new tab) ↗
The actors used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144 to gain privileged…
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.