CVE-2020-0606

HIGH

.NET Framework - Remote Code Execution via Unchecked File Markup

Title source: llm

Description

A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user, aka '.NET Framework Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0605.

References (1)

Core 1

Core References

Patch, Vendor Advisory x_refsource_misc

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0606

Scores

CVSS v3 8.8

EPSS 0.3227

EPSS Percentile 96.9%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-20

Status published

Products (16)

microsoft/.net_core 3.0

microsoft/.net_core 3.1

microsoft/.net_framework 3.0 sp2

microsoft/.net_framework 3.5

microsoft/.net_framework 4.6.2

microsoft/.net_framework 4.7

microsoft/.net_framework 4.7.1

microsoft/.net_framework 4.7.2

microsoft/.net_framework 4.8

microsoft/.net_framework 3.5.1

... and 6 more

Published Jan 14, 2020

Tracked Since Feb 18, 2026