What is the CVSS score of CVE-2020-0601?

CVE-2020-0601 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 89.4%.

Is there a public PoC exploit available for CVE-2020-0601?

Yes, a public proof-of-concept exploit is available for CVE-2020-0601. Prioritise patching immediately. EPSS: 89.4%.

Is there a patch available for CVE-2020-0601?

Yes, a patch is available for CVE-2020-0601. Update the affected software to the latest version immediately.

Windows 10 1507 CVE-2020-0601

HIGH

Improper Certificate Validation (CWE-295)

2020-01-14 secure@microsoft.com

Microsoft Information Disclosure Windows 10 1507 Windows 10 1607 Windows 10 1709 Windows 10 1803 Windows 10 1809 Windows 10 1903 Windows 10 1909 Windows Server 1803 Windows Server 1903 Windows Server 1909 Windows Server 2016 Windows Server 2019 Go

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Jan 14, 2020 - 23:15 nvd

HIGH 8.1

DescriptionNVD

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

AnalysisAI

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified under CWE-295. A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'. Affected products include: Microsoft Windows 10 1507, Microsoft Windows 10 1607, Microsoft Windows 10 1709, Microsoft Windows 10 1803, Microsoft Windows 10 1809.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.