PT-2020-4017 · Microsoft · Exchange Server

Mr_Me + 1 · CVE-2020-16875 · Published 2020-09-08 · Updated 2026-06-17

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Exchange server (affected versions not specified)

Description A remote code execution issue exists due to improper validation of cmdlet arguments. An attacker could exploit this to run arbitrary code in the context of the System user. Successful exploitation requires the compromise of an authenticated user assigned to a specific Exchange role.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

RCE

Code Injection

Special Elements Injection

Improper Privilege Management

Weakness Enumeration

CWE-94

CWE-74

CWE-269

Related Identifiers

BDU:2020-04417

CVE-2020-16875

Affected Products

Exchange Server

References · 19

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/exchange_ecp_dlp_policy.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/159210/Microsoft-Exchange-Server-DlpUtils-AddTenantDlpPolicy-Remote-Code-Execution.html · Exploit
• https://osv.dev/vulnerability/CVE-2020-16875 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16875 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/656718 · Security Note
• https://bdu.fstec.ru/vul/2020-04417 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16875 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16875 · Security Note
• https://twitter.com/threatcluster/status/2067261222030827586 · Twitter Post
• https://t.me/bizone_channel/213 · Telegram Post
• https://t.me/hnews/32385 · Telegram Post
• https://t.me/hybgl/649 · Telegram Post
• https://t.me/defcon_news/77039 · Telegram Post
• https://t.me/cybersecuritytechnologies/1751 · Telegram Post
• https://t.me/pentestingnews/5979 · Telegram Post