Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2019-0720

A remote code execution vulnerability exists when Windows Hyper-V Network Switch on a host server fails to properly validate input from an authenticated user on a guest operating system. To exploit the vulnerability, an attacker could run a specially crafted application on a guest operating system that could cause the Hyper-V host operating system to execute arbitrary code. An attacker who successfully exploited the vulnerability could execute arbitrary code on the host operating system. The security update addresses the vulnerability by correcting how Windows Hyper-V Network Switch validates guest operating system network traffic.

Published

2019-08-14T21:15:12.953

Last Modified

2024-11-21T04:17:10.087

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.0 (HIGH)

CVSSv2 Vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

  • Access Vector: ADJACENT_NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

5.1

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-20
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System microsoft windows_10 - Yes
Operating System microsoft windows_10 1607 Yes
Operating System microsoft windows_10 1703 Yes
Operating System microsoft windows_10 1709 Yes
Operating System microsoft windows_10 1803 Yes
Operating System microsoft windows_10 1809 Yes
Operating System microsoft windows_7 - Yes
Operating System microsoft windows_8.1 - Yes
Operating System microsoft windows_server_2008 - Yes
Operating System microsoft windows_server_2008 r2 Yes
Operating System microsoft windows_server_2012 - Yes
Operating System microsoft windows_server_2012 r2 Yes
Operating System microsoft windows_server_2016 - Yes
Operating System microsoft windows_server_2016 1803 Yes
Operating System microsoft windows_server_2019 - Yes
References