CVE-2020-1472:

Zerologon (CVE-2020-1472) is a critical elevation of privilege vulnerability in Microsoft's Netlogon Remote Protocol that allows attackers to establish vulnerable secure channel connections to domain controllers, potentially gaining domain administrator access without authentication.

The Zerologon vulnerability affects the Netlogon Remote Protocol, which is used for user and machine authentication on domain-based networks. The vulnerability exists because of an improper implementation of cryptographic authentication between clients and domain controllers, specifically in how the AES-CFB8 encryption is initialized with a static, predictable initialization vector of all zeros instead of using a random one. This allows attackers to: 1. Impersonate any computer on the network to a domain controller 2. Disable security features in the Netlogon authentication process 3. Change a computer's password on the domain controller 4. Completely take over a Windows domain by setting a blank password for the domain controller account The attack requires network access but no authentication, making it particularly dangerous in corporate environments. Once exploited, attackers can gain complete control over the Active Directory domain and all computers joined to it.