Description
<p>A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.</p>
<p>To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.</p>
<p>The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.</p>
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 Version 1803 | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1809 | 10.0.0 – < publication | publication |
| Microsoft | Windows Server 2019 | 10.0.0 – < publication | publication |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1909 | 10.0.0 – < publication | publication |
| Microsoft | Windows Server, version 1909 (Server Core installation) | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1709 for 32-bit Systems | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1709 | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1903 for 32-bit Systems | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1903 for x64-based Systems | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 1903 for ARM64-based Systems | 10.0.0 – < publication | publication |
| Microsoft | Windows Server, version 1903 (Server Core installation) | 10.0.0 – < publication | publication |
| Microsoft | Windows 10 Version 2004 | 10.0.0 – < publication | publication |
| Microsoft | Windows Server version 2004 | 10.0.0 – < publication | publication |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 15 repositories · most starred shown
-
advanced-threat-research/CVE-2020-16898 ★ 209 · Oct 7, 2020
CVE-2020-16898 (Bad Neighbor) Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule
-
0xeb-bp/cve-2020-16898 ★ 22 · Oct 16, 2020
PoC BSOD for CVE-2020-16898 (badneighbor)
-
ZephrFish/CVE-2020-16898 ★ 22 · Oct 14, 2020
HoneyPoC 2.0: Proof-of-Concept (PoC) script to exploit IPv6 (CVE-2020-16898).
-
momika233/CVE-2020-16898-exp ★ 17 · Oct 17, 2020
-
komomon/CVE-2020-16898--EXP-POC ★ 12 · Oct 28, 2020
CVE-2020-16898 Windows TCP/IP远程代码执行漏洞 EXP&POC
-
jiansiting/cve-2020-16898 ★ 9 · Oct 17, 2020
PoC BSOD for CVE-2020-16898
-
corelight/CVE-2020-16898 ★ 9 · Oct 14, 2020
A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)
-
komomon/CVE-2020-16898-EXP-POC ★ 5 · Oct 20, 2020
CVE-2020-16898 Windows TCP/IP远程代码执行漏洞 EXP&POC
-
Maliek/CVE-2020-16898_Check ★ 2 · Oct 14, 2020
Minor powershell script that checks for vulnerable interfaces.
-
initconf/CVE-2020-16898-Bad-Neighbor ★ 2 · Oct 14, 2020
Zeek detection for CVE-2020-16898-"Bad Neighbor"
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 1
- SCA-2020-0005 Package Analytics affected by Windows TCP/IP vulnerability SICK PSIRT · Oct 29, 2020