CVE-2020-0601
KEVHIGH 8.1EPSS 89.4%
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
- Affected
- Microsoft · Windows · Windows Server · Windows 10 Version 1903 for 32-bit Systems · Windows 10 Version 1903 for x64-based Systems · Windows 10 Version 1903 for ARM64-based Systems · Windows Server, version 1903 (Server Core installation)
- CVSS v3.1 NVD
- 8.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N - CVSS v2.0 NVD
- 5.8 MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:N - EPSS
- 89.44% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03
- Published
- 2020-01-14
- Updated
- 2025-10-21
Proof-of-concept exploits (34)
- http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofin…
- http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofin…
- 0xxon/cve-2020-060135★ · 2022-07-09
- 0xxon/cve-2020-0601-plugin5★ · 2020-02-12
- 0xxon/cve-2020-0601-utils0★ · 2020-01-21
- AdavVegab/PoC-Curveball0★ · 2022-12-13
- Ash112121/CVE-2020-06010★ · 2020-01-20
- BlueTeamSteve/CVE-2020-06011★ · 2020-02-03
- Hans-MartinHannibalLauridsen/CurveBall1★ · 2023-05-30
- IIICTECH/-CVE-2020-0601-ECC---EXPLOIT3★ · 2020-01-19
- JPurrier/CVE-2020-06010★ · 2020-01-17
- JoelBts/CVE-2020-0601_PoC0★ · 2024-05-16
- MarkusZehnle/CVE-2020-06010★ · 2020-01-17
- RrUZi/Awesome-CVE-2020-06015★ · 2020-02-02
- YoannDqr/CVE-2020-06012★ · 2020-01-20
- amlweems/gringotts1★ · 2020-01-30
- apodlosky/PoC_CurveBall0★ · 2020-02-19
- dlee35/curveball_lua0★ · 2020-01-19
- eastmountyxz/CVE-2020-0601-EXP30★ · 2020-02-17
- exploitblizzard/CVE-2020-0601-spoofkey0★ · 2021-03-14
- gremwell/cve-2020-0601_poc2★ · 2020-02-19
- ioncodes/Curveball20★ · 2022-03-06
- kudelskisecurity/chainoffools336★ · 2023-05-09
- kudelskisecurity/northsec_crypto_api_attacks1★ · 2023-05-19
- ly4k/CurveBall890★ · 2020-01-20
- modubyk/CVE_2020_06010★ · 2022-02-09
- nissan-sudo/CVE-2020-06012★ · 2020-01-14
- okanulkr/CurveBall-CVE-2020-0601-PoC0★ · 2021-03-27
- saleemrashid/badecparams66★ · 2026-04-11
- thimelp/cve-2020-0601-Perl0★ · 2020-01-18
- yanghaoi/CVE-2020-06011★ · 2021-04-08
- yshneyderman/CS590J-Capstone1★ · 2021-05-03
- ztora/msvuln0★ · 2022-12-12
- CrackerCat/CurveballCertTool0★ · 2020-02-06