An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure…

CVE-2020-1472 — universally known as Zerologon — is a cryptographic flaw in Microsoft's Netlogon Remote Protocol (MS-NRPC). The AES-CFB8 implementation uses a fixed, all-zero initialization vector (IV), which means an unauthenticated attacker on the network can send ~256 specially crafted Netlogon authentication attempts to a domain controller and, on average within seconds, reset that DC's machine account password to a known empty value. From there, the attacker performs a DCSync to harvest every credential in the domain — including krbtgt. Affected: every supported Windows Server version running the DC role — Server 2008 R2, 2012, 2012 R2, 2016, 2019, and their Server Core variants. Patched in the August 2020 Patch Tuesday with enforcement mode enabled by default in February 2021.

The user-supplied metadata for this CVE is incorrect. The provided vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, 5.5 MEDIUM) belongs to a different vulnerability. Microsoft and NVD both scored Zerologon at 10.0 CRITICAL with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That score is completely justified: the attack is network-based, requires no authentication, no user interaction, has low complexity, and the blast radius crosses every security boundary in an AD environment. Six years post-disclosure, this CVE still appears in ransomware kill chains (Ryuk, Conti, Cuba, LockBit playbooks) and APT campaigns (Mercury/MuddyWater, TA505). CISA issued Emergency Directive 20-04 specifically for this vulnerability — one of the few CVEs to ever receive that treatment. The EPSS score of 0.97+ (97th+ percentile) confirms that exploitation probability remains among the highest of any CVE in the catalog.

Why this verdict

• Role multiplier: The affected component is *by definition* a domain controller — 100% of vulnerable installs occupy the highest-value identity role. A successful chain ends in full AD forest compromise (DA → Golden Ticket → every host). This sets a CRITICAL floor that no friction analysis can breach.
• Weaponization saturation: Public, reliable, one-click exploits exist in Mimikatz, Impacket, Metasploit, and dozens of standalone GitHub repos. The attack completes in under 5 seconds with zero authentication. There is no skill barrier.
• Confirmed mass exploitation: KEV-listed, CISA Emergency Directive, documented use in Ryuk, Conti, Cuba, LockBit ransomware campaigns and nation-state APT operations (Mercury, TA505). EPSS 97th+ percentile confirms ongoing exploitation probability.
• Scope change in CVSS is literal: Compromise of one DC cascades to every domain-joined host, every user credential, every Group Policy object, and every trust relationship in the forest. The blast radius is fleet-scale by design.
• Internal network prerequisite is not meaningful friction: Every domain-joined workstation, server, and VPN client has network access to at least one DC. An attacker who lands anywhere on the internal network (phishing, VPN compromise, supply chain) can immediately pivot to Zerologon. This prerequisite filters out only pure external attackers with zero foothold — a population that already has cheaper targets.

Why not higher?

This is already the maximum score of 10.0 CRITICAL. There is no higher severity bucket. The vulnerability represents the theoretical ceiling of impact: unauthenticated, low-complexity, scope-changing, full-confidentiality/integrity/availability destruction of the enterprise identity plane.

Why not lower?

Downgrading below CRITICAL would require evidence that the domain controller role is somehow low-value or that the attack chain has meaningful friction. Neither is true. The DC is the canonical high-value target in every Windows enterprise, the exploit is trivially reliable, and the blast radius is every host in the domain. The 'requires internal network' prerequisite does not constitute meaningful friction because internal network access to DCs is the *default state* for every domain-joined machine. Additionally, active KEV listing and confirmed ransomware campaign usage independently mandate maximum urgency.

1. Verify enforcement mode is active on ALL domain controllers immediately — Check the registry key HKLM\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters\FullSecureChannelProtection is set to 1 on every DC. The February 2021 update enables this by default, but manual overrides or GPO misconfigurations can disable it. This is the single most important compensating control — deploy within 3 days per noisgate mitigation SLA for CRITICAL.
2. Block Netlogon RPC from non-DC and non-domain-member sources — Use Windows Firewall or network ACLs to restrict inbound Netlogon/RPC (TCP 135 + dynamic range) on DCs to only known domain controllers and legitimate domain members. This limits the attacker population that can reach the vulnerable service. Deploy within 3 days.
3. Enable Microsoft Defender for Identity Zerologon detection — MDI has a specific alert for 'Suspected Netlogon privilege elevation attempt (CVE-2020-1472)'. Ensure this is enabled and routed to your SOC with HIGH priority. If you don't run MDI, deploy IDS signatures (Snort SID 55703, Suricata ET rules) on DC network segments.
4. Monitor for DCSync from non-DC sources — Alert on Windows Security Event ID 4662 with properties DS-Replication-Get-Changes and DS-Replication-Get-Changes-All where the source is not a domain controller. This catches the post-exploitation step even if the initial exploit is missed.
5. Audit for EOL domain controllers — Windows Server 2003 and 2008 (non-R2) are vulnerable and will never receive a patch. If any of these are still running as DCs, decommission them immediately — they are permanent Zerologon targets.

Run this script on each domain controller with Domain Admin or local admin privileges. It checks both the patch level (August 2020 KB) and the enforcement mode registry key. Example: powershell -ExecutionPolicy Bypass -File .\Check-Zerologon.ps1

#Requires -RunAsAdministrator
<#
  Check-Zerologon.ps1
  Checks whether this domain controller is protected against CVE-2020-1472 (Zerologon).
  Outputs: VULNERABLE / PATCHED / UNKNOWN
  Exit codes: 1 = VULNERABLE, 0 = PATCHED, 2 = UNKNOWN
#>

$ErrorActionPreference = 'Stop'
$status = 'UNKNOWN'
$exitCode = 2
$findings = @()

try {
    # Check 1: Is this even a domain controller?
    $os = Get-WmiObject Win32_OperatingSystem
    $isDC = (Get-WmiObject Win32_ComputerSystem).DomainRole -ge 4
    if (-not $isDC) {
        Write-Host "INFO: This host is NOT a domain controller. Zerologon is only exploitable on DCs."
        Write-Host "PATCHED"
        exit 0
    }
    $findings += "Host is a Domain Controller: YES"

    # Check 2: Look for August 2020+ cumulative update
    $hotfixes = Get-HotFix | Sort-Object InstalledOn -Descending -ErrorAction SilentlyContinue
    # Key KBs for Zerologon Phase 1 (August 2020)
    $phase1KBs = @('KB4565349','KB4571694','KB4571702','KB4571703','KB4571723','KB4571729','KB4571736')
    $foundPhase1 = $false
    foreach ($kb in $phase1KBs) {
        if ($hotfixes.HotFixID -contains $kb) {
            $foundPhase1 = $true
            $findings += "Phase 1 patch found: $kb"
            break
        }
    }
    # Also check if any cumulative update post-August 2020 is present
    $recentPatches = $hotfixes | Where-Object { $_.InstalledOn -gt [datetime]'2020-08-11' }
    if ($recentPatches.Count -gt 0 -and -not $foundPhase1) {
        $findings += "Post-August-2020 updates found ($(($recentPatches | Select-Object -First 3).HotFixID -join ', '))"
        $foundPhase1 = $true
    }

    # Check 3: Enforcement mode registry key
    $regPath = 'HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters'
    $enforcementValue = $null
    try {
        $enforcementValue = (Get-ItemProperty -Path $regPath -Name 'FullSecureChannelProtection' -ErrorAction Stop).FullSecureChannelProtection
    } catch {
        $findings += "FullSecureChannelProtection registry key: NOT FOUND (may rely on Feb 2021 default)"
    }

    if ($enforcementValue -eq 1) {
        $findings += "FullSecureChannelProtection: ENABLED (enforcement mode ON)"
    } elseif ($enforcementValue -eq 0) {
        $findings += "FullSecureChannelProtection: DISABLED (enforcement mode OFF - DANGEROUS)"
    }

    # Check 4: Determine verdict
    if ($enforcementValue -eq 0) {
        # Enforcement explicitly disabled - vulnerable even if patched
        $status = 'VULNERABLE'
        $exitCode = 1
        $findings += 'REASON: Enforcement mode is explicitly DISABLED via registry. This DC is exploitable.'
    } elseif ($foundPhase1 -and ($enforcementValue -eq 1 -or $enforcementValue -eq $null)) {
        # Patched and enforcement not explicitly disabled (Feb 2021 default applies)
        $status = 'PATCHED'
        $exitCode = 0
    } elseif (-not $foundPhase1) {
        $status = 'VULNERABLE'
        $exitCode = 1
        $findings += 'REASON: No August 2020 or later cumulative update detected.'
    } else {
        $status = 'UNKNOWN'
        $exitCode = 2
    }

} catch {
    $findings += "Error during check: $($_.Exception.Message)"
    $status = 'UNKNOWN'
    $exitCode = 2
}

Write-Host ''
Write-Host '=== CVE-2020-1472 (Zerologon) Check ===' -ForegroundColor Cyan
foreach ($f in $findings) { Write-Host "  $f" }
Write-Host ''
Write-Host $status -ForegroundColor $(if ($status -eq 'VULNERABLE') {'Red'} elseif ($status -eq 'PATCHED') {'Green'} else {'Yellow'})
exit $exitCode

Sources

1. NVD - CVE-2020-1472
2. CISA Emergency Directive 20-04
3. Secura Zerologon Whitepaper
4. CrowdStrike - Zerologon Overview and Prevention
5. Rapid7 Analysis - CVE-2020-1472
6. dirkjanm Zerologon PoC (GitHub)
7. Tenable - Zerologon Enforcement Mode
8. CISA KEV Catalog Entry