CVE-2020-0601

Confirmed PUBLISHED

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker...

Microsoft · Windows, Windows Server, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation), Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows Server, version 1909 (Server Core installation), Windows 10 Version 1909 for ARM64-based Systems

Exploited in the wild PoC available

Recommended Action

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.

View KEV Feed Talk to Sales

Confidence

Confirmed

Exploitation Status

Exploited in the wild

Observed in Sensors

Attempts (30d)

—

Unique Attacker IPs

—

CISA KEV

In CISA KEV

CVSS / EPSS

8.1 High

At a Glance

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

windows microsoft cisa

CVE Published: Jan 14, 2020
Exploitation Reported: Nov 03, 2021
CVSS: 8.1 High
EPSS: —

Remote Low complexity Unauthenticated

Affected Versions

26 version rows · page 1 of 2

Vendor	Product	Version	Status
Microsoft	Windows	10 Version 1803 for 32-bit Systems	Affected
Microsoft	Windows	10 Version 1803 for x64-based Systems	Affected
Microsoft	Windows	10 Version 1803 for ARM64-based Systems	Affected
Microsoft	Windows	10 Version 1809 for 32-bit Systems	Affected
Microsoft	Windows	10 Version 1809 for x64-based Systems	Affected
Microsoft	Windows	10 Version 1809 for ARM64-based Systems	Affected
Microsoft	Windows	10 Version 1709 for 32-bit Systems	Affected
Microsoft	Windows	10 Version 1709 for x64-based Systems	Affected
Microsoft	Windows	10 Version 1709 for ARM64-based Systems	Affected
Microsoft	Windows	10 for 32-bit Systems	Affected
Microsoft	Windows	10 for x64-based Systems	Affected
Microsoft	Windows	10 Version 1607 for 32-bit Systems	Affected
Microsoft	Windows	10 Version 1607 for x64-based Systems	Affected
Microsoft	Windows Server	version 1803 (Core Installation)	Affected
Microsoft	Windows Server	2019	Affected
Microsoft	Windows Server	2019 (Core installation)	Affected
Microsoft	Windows Server	2016	Affected
Microsoft	Windows Server	2016 (Core installation)	Affected
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified	Affected
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified	Affected
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified	Affected
Microsoft	Windows Server, version 1903 (Server Core installation)	unspecified	Affected
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified	Affected
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified	Affected
Microsoft	Windows Server, version 1909 (Server Core installation)	unspecified	Affected

CVE References

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601 portal.msrc.microsoft.com · CVE Record https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CV...
packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-Cry... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windo...
packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-Cry... packetstormsecurity.com · CVE Record http://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windo...

Recommended Actions

Prioritize remediation. Validate affected assets and apply vendor fixes on an accelerated timeline.
Check enrichment artifacts for scanner coverage and available PoCs before rolling remediation validation.
Use the Pro API to automate enrichment, telemetry, and workflow delivery for VM, SOC, and CTI pipelines.

Known Exploited Vulnerability Sources

Catalogues that list this CVE as a known exploited vulnerability.

Per-source evidence links for KEV attestations are available through the KEVIntel Pro API.

Learn about Pro API access

Source	Added
CISA First	2021-11-03 00:00 UTC

CVSS Scores

CVSS v3.1 8.1 High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

CVSS v2.0 5.8 Medium

AV:N/AC:M/Au:N/C:P/I:P/A:N

Exploitation Status

Exploited in the wild

Recorded 2021-11-03 00:00:00 UTC · CISA

Proof of concept available

Recorded 2020-01-14 23:53:18 UTC · GitHub

Weaknesses (CWE)

CWE-295

Improper Certificate Validation

Potential Proof of Concepts

These PoCs are unverified and could contain malware. Use at your own risk.

eastmountyxz/CVE-2020-0601-EXP

github · Created 2020-02-17 15:01:54 UTC · 30 stars

这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，理解ECC算法、Windows验证机制，并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者，自己确实很菜，但希望坚持下去，加油！

yanghaoi/CVE-2020-0601

github · Created 2020-02-03 13:58:07 UTC · 1 stars

PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll) POC: https://github.com/ollypwn/CurveBall

IIICTECH/-CVE-2020-0601-ECC---EXPLOIT

github · Created 2020-01-19 18:20:26 UTC · 3 stars

CurveBall (CVE-2020-0601) - PoC CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography (ECC) is not correctly verified. Attackers can supply hand-rolled generators, bypassing validation, antivirus & all non-protections.

YoannDqr/CVE-2020-0601

github · Created 2020-01-17 17:17:55 UTC · 2 stars

CurveBall CVE exploitation

MarkusZehnle/CVE-2020-0601

github · Created 2020-01-17 16:24:31 UTC · 0 stars

BlueTeamSteve/CVE-2020-0601

github · Created 2020-01-16 12:40:48 UTC · 1 stars

Curated list of CVE-2020-0601 resources

RrUZi/Awesome-CVE-2020-0601

github · Created 2020-01-16 02:46:21 UTC · 5 stars

😂An awesome curated list of repos for CVE-2020-0601.

SherlockSec/CVE-2020-0601

github · Created 2020-01-15 17:26:58 UTC · 1 stars

A Windows Crypto Exploit

nissan-sudo/CVE-2020-0601

github · Created 2020-01-14 23:53:18 UTC · 2 stars

Remote Code Execution Exploit

Automate This Intelligence with the Pro API

Confidence scoring, exploit status, sensor telemetry, PoCs, scanner integrations, mentions, and tags are available programmatically for VM, SOC, and CTI workflows.

View Pro Pricing View API Docs

Pro API Example

GET /api/v2/pro/kevs/CVE-2020-0601

{
  "cve_id": "CVE-2020-0601",
  "title": "A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) va...",
  "affected_vendor": "Microsoft",
  "affected_product": "Windows, Windows Server, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation), Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows Server, version 1909 (Server Core installation), Windows 10 Version 1909 for ARM64-based Systems",
  "affected_versions": [
    { "vendor": "...", "product": "...", "status": "affected", "display_label": "..." }
  ],
  "confidence": "Confirmed",
  "cvss_score": 8.1,
  "epss_score": null,
  "exploit_status": {
    "exploited_in_the_wild": true,
    "active_exploitation_observed": false
  },
  "sensor_telemetry": { "...": "Pro API fields" },
  "proof_of_concepts": [ "..." ],
  "scanner_integrations": [ "..." ]
}

The free JSON API returns basic KEV fields only. Confidence, telemetry, and artifact enrichment require Pro API access.

CVE-2020-0601

At a Glance

Affected Versions

CVE References

Recommended Actions

Known Exploited Vulnerability Sources

Virtual Patch

CVSS Scores

Exploitation Status

Weaknesses (CWE)

Potential Proof of Concepts

Timeline

Automate This Intelligence with the Pro API