News for hackers. Stuff that matters.

A comment on CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vulnerability.

Re:CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vul... by mrpippy on Tuesday October 13, 2020 @02:58PM (#24768907)
Sophos says achieving RCE is extremely difficult: https://news.sophos.com/en-us/2020/10/13/top-reason-to-apply...

I also assume that routers won't pass ICMPv6 RAs, so limited to a single network segment. And, only affects Windows 10.

[ Parent | on HN ]
Re:CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vul... by ingomaro on Tuesday October 13, 2020 @04:37PM (#24770039)
Microsofts own CVSS score says 'attack complexity' is low.

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=...

[ Parent | on HN ]
Re:CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vul... by zxcmx on Tuesday October 13, 2020 @11:38PM (#24772890)
Both can be true; BSOD is trivial, RCE can be very hard.
[ Parent | on HN ]
Re:CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vul... by WalterSobchak on Tuesday October 13, 2020 @04:09PM (#24769761)
It's not just Windows 10.
[ Parent | on HN ]
Re:CVE-2020-16898 – Windows TCP/IP Remote Code Execution Vul... by mrpippy on Tuesday October 13, 2020 @05:36PM (#24770599)
There aren't any Windows versions before W10 1709 (or Windows Server before 2019) listed in the release.
[ Parent | on HN ]