CVE-2020-0796
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Executi...
Affects 4 products across 2 vendors.
Parent class for buffer-related vulnerabilities where operations exceed buffer boundaries.
Show all 12
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
CVE-2020-0796 is a critical remote code execution vulnerability affecting Microsoft's SMBv3 protocol. This vulnerability allows an attacker to execute arbitrary code on the target system by sending specially crafted packets. Given its high CVSS score of 10.0 and the availability of public exploits, immediate attention is required to mitigate the risk, especially in ICS/OT environments where safety and uptime are paramount.
BSID: BS-2020-GLOBAL-170715-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2020-0796?
What is the CVSS score for CVE-2020-0796?
Is CVE-2020-0796 actively exploited?
How do I remediate CVE-2020-0796?
What systems are affected by CVE-2020-0796?
What NERC-CIP standard applies to CVE-2020-0796?
What IEC 62443 requirement maps to CVE-2020-0796?
| CVE ID | CVE-2020-0796 |
|---|---|
| BSID | BS-2020-GLOBAL-170715-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2020-03-12 |
| Last Modified | 2026-10-01 |
| ICS Relevance | 70% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.
Source: NIST NVD / MITRE CVE Database
The vulnerability is triggered when the SMBv3 protocol improperly handles certain requests. An attacker can exploit this issue by sending maliciously crafted packets to the target system, leading to remote code execution. The attack can be performed over the network without any user interaction, making it particularly dangerous in environments where SMBv3 is exposed to untrusted networks.
Exploitation Likelihood: HIGH
| Vendor | Product | Affected Versions |
|---|---|---|
| Microsoft | Windows 10 1909 | No version listed by source |
| Microsoft | Windows 10 1903 | No version listed by source |
| Microsoft | Windows Server 1903 | No version listed by source |
| Microsoft | Windows Server 1909 | No version listed by source |
| Schneider-Electric | — | — |
No official vendor advisory link on record. See the CVE record →
| CISA known-exploited | ● Active Exploitation Confirmed (added 2022-02-10) |
|---|---|
| Public Exploit | ⚠ Available — Reference |
| PoC Code | Not confirmed |
Implement network segmentation to isolate critical ICS/OT systems from general IT networks. Use firewalls to restrict access to SMBv3 ports (TCP 445) and monitor for suspicious activity.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
This vulnerability violates CIP-007-R2 as it allows unauthorized access to critical cyber assets, potentially leading to loss of control or damage to the power system.
This vulnerability aligns with SR 7.6, which requires the implementation of secure communication protocols to prevent unauthorized access and manipulation of industrial control systems.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | 84b0b57a26025b4cea3559899348386c56e32709e1be5bdbbb8635ab816429d205f343d67d673c4bec6c79311cd554a7548b70b6f413dc134f152a997e80f4af |
This Vulnerability Is Being Actively Exploited
CVE-2020-0796 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →