Remote Code Execution Vulnerability in Internet Explorer by Microsoft
CVE-2020-0674

7.5HIGH

Key Information:

Vendor: Microsoft
Status: Internet Explorer 10; Internet Explorer 11; Internet Explorer 11 On Windows 10 Version 1909 For 32-bit Systems; Internet Explorer 11 On Windows 10 Version 1909 For X64-based Systems
Vendor: CVE Published:; 11 February 2020

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 86%🦅 CISA Reported

What is CVE-2020-0674?

A remote code execution vulnerability has been identified in Internet Explorer, stemming from the scripting engine's mishandling of objects in memory. This flaw can allow an attacker to execute arbitrary code on a victim's system if they manage to convince the user to view a specially crafted web page. Successful exploitation could result in the attacker gaining the same user rights as the current user, thereby posing significant risks to users who have Internet Explorer installed and are running unpatched versions.

CISA has reported CVE-2020-0674

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2020-0674 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Internet Explorer 10 Windows Server 2012

Internet Explorer 11 Windows 10 Version 1803 for 32-bit Systems

Internet Explorer 11 Windows 10 Version 1803 for x64-based Systems

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-0674-Exploit
Created by maxpl0it

CVE-2020-0674-PoC
Created by Neko-chanQwQ

CVE-2020-0674
Created by Ken-Abruzzi