# MA-793.102020: MyCERT Alert - Netlogon Elevation of Privilege Vulnerability (ZeroLogon)

**Date:** 01 Oct 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-793.102020  
**Advisory ID:** MA-793.102020

---

**1.0 IntroductionCVE-2020-1472**, more popularly known as “**Zerologon**”, is a critical vulnerability in all versions of Microsoft Windows Server that are currently supported (Windows 2008 R2, 2012, 2016, 2019, and SAC from 1903 and above).
This vulnerability is located in Microsoft Windows Netlogon Remote Protocol (**MS-NRPC**), an area that is responsible for the authentication of Active Directory. It’s named “Zerologon” because if an attacker can successfully deploy this exploit, it’s authenticated by submitting a string of zeros. It allows an attacker to impersonate a system, including the machine account of the domain controller itself.
Microsoft has warned that malicious hackers are currently exploiting this vulnerability in the wild that could be used to give attackers inside a vulnerable corporate network. Microsoft’s warning comes just days after the U.S. Department of Homeland Security issued an emergency directive instructing all federal agencies to patch the vulnerability.
**2.0 Impact**
A remote attacker could exploit this vulnerability to potentially take control of all affected Microsoft Windows devices in vulnerable organization.
**3.0 Affected System and Devices**
- Windows Server 2008 R2.
- Windows Server 2012.
- Windows Server 2012 R2.
- Windows Server 2016.
- Windows Server 2019.
- Windows Server, version 1903.
- Windows Server, version 1909.
- Windows Server, version 2004.
**4.0 Recommendations**
Please refer to the Microsoft Security Update page at the given reference URL below.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.secura.com/blog/zero-logon>
- <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472>
- <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1472>
- <https://nvd.nist.gov/vuln/detail/CVE-2020-1472>
- <https://github.com/SecuraBV/CVE-2020-1472>