Cloudanix VulnDB

CVE-2020-1350

Critical · 10.0 CISA KEV

CVSS

10.0

EPSS

96.7%

Published

Jul 14, 2020

CISA due date

May 3, 2022

Cloudanix analysis

Act now SSVC: Attend

A critical flaw in Windows DNS servers lets attackers remotely take over systems handling network name lookups, risking complete network control.

Active In The Wild Wormable
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
Network Service
Class
RCE
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Remote code execution on Windows DNS servers due to improper handling of DNS requests, allowing arbitrary code execution with system-level privileges over the network.

Why it matters to the business

Full compromise of DNS infrastructure enabling domain takeover, lateral movement, data breaches, and service outages; high urgency from CISA KEV listing with remediation deadline of 2022-05-03 and active exploitation in the wild.

How an attack unfolds

An attacker sends a specially crafted DNS request to a vulnerable Windows DNS server, exploiting the flaw to achieve remote code execution; known to be actively exploited in the wild.

How to fix it

Apply vendor patches immediately; for affected knowagelabs/knowage-server (GIT) upgrade to commit 7c67b838c4057e4d50d7bb1d1727b47a0fcd500f.

How to confirm the fix worked

Verify DNS server version against patched releases, test with known exploit PoCs in isolated environments, and confirm absence of vulnerable code paths.

Typical attack path

  1. Scan for exposed Windows DNS servers
  2. Send malformed DNS query to trigger the vulnerability
  3. Achieve remote code execution
  4. Deploy payloads for persistence or ransomware deployment

How to detect it

Review Windows DNS server logs and event logs for unusual query patterns or error conditions associated with malformed requests; look for process creation events following DNS activity.

What your security team should do

  • Prioritize patching all Windows DNS servers due to KEV status and active exploitation
  • Monitor network traffic for anomalous DNS requests
  • Implement network segmentation around DNS infrastructure
  • Review logs for post-exploitation indicators

The record

A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.

Affected packages

Ecosystem Package Introduced Fixed