CVE-2020-1350
KEVCRITICAL 10.0EPSS 96.7%
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
- Affected
- Microsoft · Windows Server · Windows Server, version 1909 (Server Core installation) · Windows Server, version 1903 (Server Core installation) · Windows Server, version 2004 (Server Core installation)
- CVSS v3.1 NVD
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - CVSS v2.0 NVD
- 10.0 HIGH
AV:N/AC:L/Au:N/C:C/I:C/A:C - EPSS
- 96.72% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2021-11-03
- Published
- 2020-07-14
- Updated
- 2025-10-21
Proof-of-concept exploits (18)
- CVEmaster/CVE-2020-13500★ · 2020-07-20
- Plazmaz/CVE-2020-1350-poc4★ · 2020-07-20
- T13nn3s/CVE-2020-135015★ · 2023-04-01
- TheCyberViking/Insider_Threat_Bait0★ · 2020-07-25
- ZephrFish/CVE-2020-1350_HoneyPoC280★ · 2026-07-31
- ZephrFish/CVE-2021-22893_HoneyPoC247★ · 2026-07-31
- ZephrFish/CVE-2021-28480_HoneyPoC310★ · 2026-07-31
- captainGeech42/CVE-2020-135018★ · 2020-07-16
- chompie1337/SIGRed_RCE_PoC267★ · 2023-07-10
- connormcgarr/CVE-2020-135011★ · 2020-07-27
- gdwnet/cve-2020-13500★ · 2020-07-22
- graph-inc/CVE-2020-13502★ · 2020-07-18
- jmaddington/dRMM-CVE-2020-1350-response0★ · 2020-07-15
- maxpl0it/CVE-2020-1350-DoS238★ · 2020-07-17
- mr-r3b00t/CVE-2020-13504★ · 2020-07-20
- tinkersec/cve-2020-1350104★ · 2020-07-15
- zoomerxsec/Fake_CVE-2020-13507★ · 2020-07-19
- sty886/CVE-2020-1350-SigRed0★ · 2026-03-07
Exploit collections (1)
- DNS Server远程代码执行漏洞(CVE-2020-1350).mdtzwlhack/Vulnerability
Security advisories
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1350
- http://packetstormsecurity.com/files/158484/SIGRed-Windows-DNS-Denial-Of-Service.html