CVE-2020-1405

HighCVSS 7.1/10Last modified Jun 17, 2026

Description

An elevation of privilege vulnerability exists when Windows Mobile Device Management (MDM) Diagnostics improperly handles junctions, aka 'Windows Mobile Device Management Diagnostics Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2020-1372.

Metrics

CVSS 3.1 7.1/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Affected software

Vendor	Product	Versions
Microsoft	Windows 10 Version 2004 for x64-based Systems	unspecified
Microsoft	Windows Server, version 2004 (Server Core installation)	unspecified
Microsoft	Windows 10 Version 2004 for ARM64-based Systems	unspecified
Microsoft	Windows 10 Version 2004 for 32-bit Systems	unspecified
Microsoft	Windows	10 Version 1809 for 32-bit Systems; 10 Version 1809 for x64-based Systems; 10 Version 1809 for ARM64-based Systems
Microsoft	Windows Server	2019
Microsoft	Windows 10 Version 1909 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1909 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1909 for ARM64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for 32-bit Systems	unspecified
Microsoft	Windows 10 Version 1903 for x64-based Systems	unspecified
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	unspecified

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1405Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1405Patch, Vendor Advisory

Timeline

Published: Jul 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-140549.8SOKKIA GNR5 Vanguard WEB version 1.2 (build: 91f2b2c3a04d203d79862f87e2440cb7cefc3cd3) and hardware version 212 allows remote attackers to b CVE-2020-140556.1Monsta FTP 2.10.1 or below is prone to a stored cross-site scripting vulnerability in the language setting due to insufficient output encodi CVE-2020-140569.8Monsta FTP 2.10.1 or below is prone to a server-side request forgery vulnerability due to insufficient restriction of the web fetch function CVE-2020-140579.8Monsta FTP 2.10.1 or below allows external control of paths used in filesystem operations. This allows attackers to read and write arbitrary CVE-2020-140587.5An issue was discovered in Squid before 4.12 and 5.x before 5.0.3. Due to use of a potentially dangerous function, Squid and the default cer CVE-2020-140596.5An issue was discovered in Squid 5.x before 5.0.3. Due to an Incorrect Synchronization, a Denial of Service can occur when processing object CVE-2020-14067.8An elevation of privilege vulnerability exists in the way that the Windows Network List Service handles objects in memory, aka 'Windows Netw CVE-2020-140608.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apac CVE-2020-140618.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQ CVE-2020-140628.1FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.a CVE-2020-140636.1A stored Cross-Site Scripting (XSS) vulnerability in the TC Custom JavaScript plugin before 1.2.2 for WordPress allows unauthenticated remot CVE-2020-140646.5IceWarp Email Server 12.3.0.1 has Incorrect Access Control for user accounts.