CVE-2020-1350
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
Affects 7 products across 2 vendors.
Software does not validate or incorrectly validates input, allowing attackers to craft data processed in unintended ways.
Show all 51
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
A critical vulnerability in Windows DNS servers allows an unauthenticated attacker to execute arbitrary code remotely. Successful exploitation could disrupt critical IT and OT infrastructure, including SCADA systems and industrial networks. Organizations using Windows DNS servers in their OT environments are at high risk and should take immediate action to mitigate this threat.
BSID: BS-2020-GLOBAL-242554-C • Model: Qwen/Qwen2.5-72B-Instruct-AWQ • Confidence: HIGH
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2020-1350?
What is the CVSS score for CVE-2020-1350?
Is CVE-2020-1350 actively exploited?
How do I remediate CVE-2020-1350?
What systems are affected by CVE-2020-1350?
What NERC-CIP standard applies to CVE-2020-1350?
What IEC 62443 requirement maps to CVE-2020-1350?
| CVE ID | CVE-2020-1350 |
|---|---|
| BSID | BS-2020-GLOBAL-242554-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| Published | 2020-07-14 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 55% |
| Weakness (CWE) | |
| Verticals | |
| Source | NVD |
A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows DNS Server Remote Code Execution Vulnerability'.
Source: NIST NVD / MITRE CVE Database
The vulnerability exists in the Windows DNS server's handling of DNS requests. An unauthenticated attacker can send a specially crafted DNS query to the DNS server, causing a buffer overflow in the DNS server's memory. This overflow can be exploited to execute arbitrary code with the privileges of the DNS service. The attacker needs no prior authentication and can operate from anywhere on the network. Post-exploitation, the attacker gains full control of the DNS server, which can be used to manipulate DNS responses, redirect traffic, and potentially compromise other systems on the network, including industrial control systems.
Exploitation Likelihood: CRITICAL
| Vendor | Product | Affected Versions |
|---|---|---|
| Microsoft | Windows Server | 2012 2016 2019 |
| Microsoft | Windows Server 2008 | r2 |
| Microsoft | Windows Server 2012 | r2 |
| Microsoft | Windows Server 2016 | No version listed by source |
| Microsoft | Windows Server 2019 | No version listed by source |
| Microsoft | Windows Server 2016 (Server Core installation) | No version listed by source |
| Microsoft | Windows Server 2019 (Server Core installation) | No version listed by source |
| Schneider-Electric | — | — |
| CISA known-exploited | ● Active Exploitation Confirmed (added 2021-11-03) |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
Implement strict DNS query validation on firewalls and DNS proxies to block malformed DNS queries. Restrict DNS server access to trusted internal networks and disable recursive queries from external sources. Apply network segmentation to isolate DNS servers from critical OT systems.
No reliable network detection signature exists for this vulnerability class — apply the compensating controls above and the vendor patch. A network rule is only drafted when a concrete on-the-wire signature can be grounded in the advisory.
CIP-007-R1 requires the identification and disabling of unnecessary ports and services. The vulnerable DNS server represents an unnecessary service if not required for BES Cyber Asset operation.
IEC 62443 SR 3.5 (Input Validation) is directly violated. The DNS server fails to validate the length and structure of incoming DNS queries, leading to a buffer overflow and potential remote code execution.
Drafted by AI and not validated for your network. Test in an isolated environment before any production deployment. Compensating control only - does not replace vendor patch.
AI Enrichment Record — provenance & audit hash
| Model | Qwen/Qwen2.5-72B-Instruct-AWQ |
|---|---|
| Confidence | HIGH |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | f31bc84ed3a60813158743cd08371e22bd15c9b6803d77f58bb7c577f1519db9a871b870f6a5681fe6a3d6af8487f044635f6a5663b5ca75693970a005d532e2 |
This Vulnerability Is Being Actively Exploited
CVE-2020-1350 is on the CISA known-exploited list - confirmed active exploitation in the wild. BreachSpider flags known-exploited CVEs on the ICS assets they affect, with known-exploited status synced daily from CISA.
Create a free account →