CVE-2020-0601

HighCVSS 8.1/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-295

Affected software

No affected versions have been published.

Timeline

Published
Jan 14, 2020
Last modified
Jun 17, 2026
Added to CISA KEV
Nov 3, 2021
NVD status
Analyzed

Related CVEs from 2020

CVE-2020-06027.5A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka 'ASP.NET Core Denial of Service VulnerabilitCVE-2020-06038.8A remote code execution vulnerability exists in ASP.NET Core software when the software fails to handle objects in memory.An attacker who suCVE-2020-06047.8A remote code execution vulnerability exists in Visual Studio Code when it process environment variables after opening a project. An attackeCVE-2020-06058.8A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who sCVE-2020-06068.8A remote code execution vulnerability exists in .NET software when the software fails to check the source markup of a file.An attacker who sCVE-2020-06075.5An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft GraphiCVE-2020-06085.5An information disclosure vulnerability exists when the win32k component improperly provides kernel information, aka 'Win32k Information DisCVE-2020-06099.8A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to theCVE-2020-06109.8A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to theCVE-2020-06117.5A remote code execution vulnerability exists in the Windows Remote Desktop Client when a user connects to a malicious server, aka 'Remote DeCVE-2020-06127.5A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system usingCVE-2020-06137.8An elevation of privilege vulnerability exists in the way that the Windows Search Indexer handles objects in memory, aka 'Windows Search Ind
CVE-2020-0601: High severity, CVSS 8.1 | Vulnix