CVE-2020-0951

published 2020-09-11

CVE-2020-0951: A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An…

Priority P3 42 medium 6.7 CVSS 3.1

AV L AC L PR H UI N S U C H I H A H

A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC.
To exploit the vulnerability, an attacker need administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code.
The update addresses the vulnerability by correcting how PowerShell commands are validated when WDAC protection is enabled.

Affected

42 ranges · showing 25

Vendor	Product	Version range	Fixed in
microsoft	powershell	—	—
microsoft	powershell	>= 7.0 < 7.0.8	7.0.8
microsoft	powershell	>= 7.1 < 7.1.5	7.1.5
microsoft	powershell_7.0	>= 7.0.0 < 7.0.8	7.0.8
microsoft	powershell_7.1	>= 7.1.0 < 7.1.5	7.1.5
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10	—	—
microsoft	windows_10_version_1607	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1709	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1709_for_32-bit_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1803	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1809	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_32-bit_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_arm64-based_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1903_for_x64-based_systems	>= 10.0.0 < publication	publication
microsoft	windows_10_version_1909	>= 10.0.0 < publication	publication
microsoft	windows_10_version_2004	>= 10.0.0 < publication	publication
microsoft	windows_server_2016	—	—
microsoft	windows_server_2016	—	—
microsoft	windows_server_2016	—	—

CVSS provenance

nvd v3.1 6.7 MEDIUM CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 7.2 HIGH AV:L/AC:L/Au:N/C:C/I:C/A:C

vendor_msrc 6.7 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-732