CVE-2020-0646: Microsoft .NET Framework Remote Code Execution Vulnerability

Vulnerability summary

CVE-2020-0646 is a high (CVSS 10.0) vulnerability in Microsoft .NET Framework. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 99.22% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 3 public exploits are recorded.

Timeline

1. 14-01-2020
   PublishedVulnerability first disclosed.
2. 03-11-2021
   Added to CISA KEVMicrosoft .NET Framework Remote Code Execution Vulnerability
3. 03-05-2022
   CISA remediation dueApply updates per vendor instructions.
4. 21-10-2025
   Last modifiedVulnerability information updated.

Description

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.

• CWE-91XML Injection (aka Blind XPath Injection)The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.