CVE-2020-1038
📋 TL;DR
CVE-2020-1038 is a denial of service vulnerability in Windows Routing Utilities where improper memory handling allows an authenticated attacker to crash the system. It affects Windows systems with vulnerable routing components. The vulnerability requires local access and specially crafted applications to trigger.
💻 Affected Systems
- Windows Routing Utilities
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system freeze or crash requiring hard reboot, disrupting all services on the affected Windows machine.
Likely Case
Temporary service disruption affecting routing functionality until system recovery or reboot.
If Mitigated
Minimal impact with proper patch management and limited user privileges preventing execution of malicious applications.
🎯 Exploit Status
Requires authenticated user to run specially crafted application. No known public exploits as of advisory publication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Security updates from June 2020 (KB4560960 for 1903/1909)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1038
Restart Required: Yes
Instructions:
1. Apply Windows Update from June 2020 or later. 2. Install security update KB4560960 for affected versions. 3. Restart system to complete installation.
🔧 Temporary Workarounds
Restrict user privileges
windowsLimit standard user ability to run arbitrary applications through application control policies
Disable unnecessary routing services
windowsTurn off Windows routing utilities if not required for system functionality
sc config RemoteAccess start= disabled
sc stop RemoteAccess
🧯 If You Can't Patch
- Implement strict application whitelisting to prevent unauthorized program execution
- Segment network to limit potential impact and monitor for unusual routing service behavior
🔍 How to Verify
Check if Vulnerable:
Check Windows version and installed updates. Vulnerable if running Windows 10 1903/1909 or Server 2019 without June 2020 security updates.Check Version:
winverVerify Fix Applied:
Verify KB4560960 or later security update is installed via 'wmic qfe list' or Settings > Update & Security > View update history📡 Detection & Monitoring
Log Indicators:
- Event ID 1000 application crashes related to routing utilities
- System freeze events in system logs
- Unexpected routing service restarts
Network Indicators:
- Sudden loss of routing functionality
- Unusual routing table changes before crash
SIEM Query:
EventID=1000 AND Source="Application Error" AND (ProcessName="*routing*" OR ApplicationName="*routing*")