CVE-2020-1472

What it actually does

An unauthenticated attacker can establish a vulnerable Netlogon secure channel connection to a domain controller via the Netlogon Remote Protocol (MS-NRPC), bypassing cryptographic checks to obtain domain administrator access and execute arbitrary code.

Why it matters to the business

Full domain compromise enabling ransomware deployment, data exfiltration, and lateral movement across the network; high urgency due to confirmed use in ransomware campaigns with a past CISA remediation deadline and near-certain exploit probability.

How an attack unfolds

An attacker uses MS-NRPC to connect to a domain controller, exploits the weak AES encryption handling in Netlogon secure channels to reset the machine account password or escalate privileges, and obtains domain administrator rights; actively exploited by Ghost (Cring) Ransomware and other actors.

How to fix it

Upgrade Samba to the fixed commit aa658ca962cfe9057741495ce9eda5d6b6965882; apply the corresponding Microsoft phased Netlogon updates; enforce the secure channel requirements after patching.

How to confirm the fix worked

Confirm the installed Samba version includes commit aa658ca962cfe9057741495ce9eda5d6b6965882; verify Netlogon secure channel enforcement settings are active via configuration checks and test connections.

Typical attack path

1. Locate an exposed domain controller accepting Netlogon connections
2. Establish an unauthenticated MS-NRPC secure channel session
3. Abuse the cryptographic weakness to perform password reset or privilege escalation operations
4. Gain domain administrator access and deploy payloads or maintain persistence

How to detect it

Review Netlogon event logs for unauthenticated or weak-encryption channel requests, machine account password resets without proper authentication, and connections matching known threat actor patterns such as Ghost ransomware activity.

• NetrServerAuthenticate2 with AES disabled
• NetrServerReqChallenge followed by password reset operations
• Event ID 5805 or equivalent Netlogon secure channel failures
• Unexpected changes to machine account passwords in domain logs

What your security team should do

• Immediately apply the Samba fixed commit or equivalent patch across all domain controllers
• Enable and monitor Netlogon secure channel enforcement logs
• Hunt for prior compromise indicators given ransomware usage and high EPSS
• Restrict unnecessary Netlogon exposure and implement network segmentation