CVE-2020-1082
📋 TL;DR
This vulnerability allows attackers to elevate privileges on Windows systems by exploiting how Windows Error Reporting (WER) handles and executes files. An authenticated attacker could execute arbitrary code with SYSTEM privileges. This affects Windows 10, Windows Server 2016, and Windows Server 2019 systems.
💻 Affected Systems
- Windows 10
- Windows Server 2016
- Windows Server 2019
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows Server by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing installation of malware, data theft, and persistent backdoors.
Likely Case
Privilege escalation from standard user to SYSTEM, enabling lateral movement and persistence establishment.
If Mitigated
Limited impact with proper patch management and least privilege principles in place.
🎯 Exploit Status
Exploit requires authenticated access and local code execution. Public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: May 2020 security updates
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1082
Restart Required: Yes
Instructions:
1. Apply May 2020 Windows security updates via Windows Update. 2. For enterprise environments, deploy through WSUS or SCCM. 3. Restart affected systems after patch installation.
🔧 Temporary Workarounds
Disable Windows Error Reporting
windowsDisables WER service to prevent exploitation
sc config WerSvc start= disabled
sc stop WerSvc
🧯 If You Can't Patch
- Implement least privilege principles to limit standard user capabilities
- Monitor for suspicious WER process activity and file creation in WER directories
🔍 How to Verify
Check if Vulnerable:
Check Windows version and if May 2020 security updates are installed. Vulnerable if running affected versions without patches.Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify KB4556799 (Windows 10 1903/1909), KB4556843 (Server 2016), or KB4556846 (Server 2019) is installed via 'wmic qfe list' or 'Get-Hotfix'.📡 Detection & Monitoring
Log Indicators:
- Unusual WER service activity
- Process creation from WER directories
- Privilege escalation events
Network Indicators:
- None - local exploitation only
SIEM Query:
EventID=4688 AND (NewProcessName contains "werfault.exe" OR NewProcessName contains "wermgr.exe") AND SubjectUserName != SYSTEM🔗 References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1082
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1082
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1082
- https://www.talosintelligence.com/vulnerability_reports/TALOS-2020-1082
