PT-2020-4281 · Microsoft · Windows Remote Desktop Protocol+1

Published 2020-10-13 · Updated 2023-12-31 · CVE-2020-16927

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: Windows Remote Desktop Protocol (RDP) (affected versions not specified)

Description: A denial of service issue exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests. This could cause the RDP service on the target system to stop responding. To exploit this issue, an attacker would need to run a specially crafted application against a server that provides Remote Desktop Protocol (RDP) services. The issue arises from insufficient input validation in Remote Desktop Services (RDS) in Windows operating systems.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-04773

CVE-2020-16927

Affected Products

Windows

Windows Remote Desktop Protocol

References · 8

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2020-16927 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16927 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16927 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04773 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-16927 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16927 · Vendor Advisory
• https://t.me/cibsecurity/15355 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2020101352 · Note