CVE-2020-0609

A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0610.

Affected

Microsoft · Windows Server

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

10.0 HIGHAV:N/AC:L/Au:N/C:C/I:C/A:C

EPSS

77.68% chance of exploitation in the next 30 days, 100th percentile

Published

2020-01-14

Updated

2024-08-04

Proof-of-concept exploits (3)

• Archi73ct/CVE-2020-06092★ · 2020-01-28
• ioncodes/BlueGate78★ · 2020-01-31
• Bhanunamikaze/BlueGate-CVE-2020-06090★ · 2026-09-07

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/47964
• https://www.exploit-db.com/exploits/47963

Security advisories

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0609

References

• CVE Record
• NVD entry

Related

• CVE-2020-0601
• CVE-2020-0610
• CVE-2020-16938
• CVE-2023-46604
• CVE-2024-42009
• CVE-2026-2587