A cryptographic flaw in the Netlogon protocol let an attacker on the network become domain administrator. Why domain controllers must be patched first.
Publicly disclosed: 11 August 2020
In the August 2020 security updates Microsoft fixed a flaw in Netlogon, the protocol computers use to authenticate to domain controllers. Because of a weakness in how it used cryptography, an attacker with network access to a domain controller could reset the controller's own account password and take over the entire Windows domain — in seconds, without any credentials. Public exploits appeared in September 2020 and ransomware groups adopted it quickly.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2020-1472 | Critical, CVSS 10.0 (privilege escalation) | Windows Server domain controllers (2008 R2 – 2019) | August 2020 updates; enforcement mode from February 2021 |
If the domain controller falls, everything behind it falls. Patch it first, not last.
Sources: Microsoft CVE-2020-1472, NVD CVE-2020-1472.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
