Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2020-1472] Takeaways from Zerologon: The Latest Domain Controller Attack

semperis.com | vulnerability | CVE-2020-1472 | #cisa | #patching | #domain-controller | #zerologon | #cve-2020-1472 | #netlogon

Summary

Takeaways from Zerologon (CVE-2020-1472): the Netlogon flaw let unauthenticated attackers reset a domain controller's password and seize domain admin rights—CVSS 10, exploits circulating—plus CISA's patch order and Microsoft's two-phase fix.
CVE
CVE-2020-1472
Published
Collected

original ↗

Related coverage

vulnerability · semperis.com
Zerologon Exploit Explained
Zerologon (CVE-2020-1472) exploits Netlogon to bypass authentication and reset a domain controller's machine account password, granting full domain control. Detection: Event ID 4742.
research · aretiq.ai
CVE-2026-41089 — Microsoft Windows Netlogon BuildSamLogonResponse Stack-based Buffer Overflow RCE
CVE-2026-41089: a stack-based buffer overflow in Windows Netlogon's CLDAP DC locator response can crash LSASS and force domain controller reboots, depending on DNS naming length.
vulnerability · semperis.com
LDAPNightmare Explained
LDAPNightmare, a SafeBreach Labs proof of concept for CVE-2024-49113, coaxes a Windows host, including a domain controller, into crashing via crafted LDAP responses from an attacker-controlled server.
vulnerability · bishopfox.com
Mind the Config: Detecting and Weaponizing NetScaler CVE-2026-19490
Bishop Fox maps NetScaler CVE-2026-19490, a CVSS 9.3 SAML bypass: one request runs post-login code, impact ranges from crash to internal proxy to root, plus a safe patch-state checker.
vulnerability · bishopfox.com
A Review of the 2021 CISA and MITRE Vulnerability Lists
A comparison of CISA's top 30 exploited vulnerabilities of 2020 and MITRE's top 25 dangerous weaknesses: origins, purposes, and bug types, plus takeaways for defenders' prioritization.
vulnerability · yeswehack.com
US House passes bill mandating vulnerability disclosure policies for federal contractors
The US House passed a bill mandating VDPs for federal contractors, consistent with NIST guidelines; the roundup also covers the UK Home Office's own vulnerability disclosure policy launch.
back