CVE-2020-16899: Windows TCP/IP Denial of Service Vulnerability

Overview

Severity
High (CVSS 7.5)
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
Category
Denial of Service
Exploit Status
Not Exploited
Exploitation Likelihood
More Likely
Patch Tuesday
2020-Oct
Released
2020-10-13
EPSS Score
40.98% (percentile: 97.4%)

Description

A denial of service vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could cause a target system to stop responding. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The vulnerability would not allow an attacker to execute code or to elevate user rights directly. The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.

Detection & Weaponization (1 sources)

Maturity: Exploit

  • GitHub PoC: 1 repositories

Affected Products (23)

Other

  • 11497
  • 11498
  • 11563
  • 11568
  • 11569
  • 11570
  • 11571
  • 11572
  • 11712
  • 11713
  • 11714
  • 11715
  • 11453
  • 11454
  • 11583
  • 11644
  • 11645
  • 11646
  • 11647
  • 11766
  • 11767
  • 11768
  • 11769

Security Updates (5)

Acknowledgments

Microsoft Platform Security Assurance & Vulnerability Research

Revision History

  • 2020-10-13: Information published.