CVE-2020-0951: Windows Defender Application Control Security Feature Bypass Vulnerability
<p>A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement. An attacker who successfully exploited this vulnerability could execute PowerShell commands that would be blocked by WDAC.</p> <p>To exploit the vulnerability, an attacker need administrator access on a local machine where PowerShell is running. The attacker could then connect to a PowerShell session and send commands to execute arbitrary code.</p> <p>The update addresses the vulnerability by correcting how PowerShell commands are validated when WDAC protection is enabled.</p>
Other sources
A security feature bypass vulnerability exists in Windows Defender Application Control (WDAC) which could allow an attacker to bypass WDAC enforcement, aka 'Windows Defender Application Control Security Feature Bypass Vulnerability'.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-0951?
CVE-2020-0951 is a security feature bypass vulnerability that exists in Windows Defender Application Control (WDAC), allowing an attacker to bypass WDAC enforcement.
Which software is affected by CVE-2020-0951?
Microsoft PowerShell versions 7.0.8 and earlier, Microsoft Windows 10 versions 1607 to 2004, and Microsoft Windows Server 2016 and 2019 are affected by CVE-2020-0951.
What is the severity of CVE-2020-0951?
CVE-2020-0951 has a severity score of 6.7, which is considered high.
How can an attacker exploit CVE-2020-0951?
An attacker can exploit CVE-2020-0951 to bypass WDAC enforcement, potentially allowing them to execute malicious code or perform unauthorized actions.
Is there a fix available for CVE-2020-0951?
Yes, Microsoft has released security updates that address CVE-2020-0951. It is recommended to apply the latest updates to protect against this vulnerability.