Microsoft Windows
CVE-2020-0601 — Windows CryptoAPI Spoofing Vulnerability
Executive Summary
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. The user would have no way of knowing the file was malicious, because the digital signature would appear to be from a trusted provider. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The security update addresses the vulnerability by ensuring that Windows CryptoAPI completely validates ECC certificates.
Overview
8.1
CVSS HIGH
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
Required
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
None
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.3
EPSS Score
0.89436
probability of exploitation in the next 30 days
0.99773 percentile - updated 2026-08-14
View on FIRST.org
Affected Products
26 affected products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 for 32-bit Systems | 4534306 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 for x64-based Systems | 4534306 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1607 for 32-bit Systems | 4534271 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1607 for x64-based Systems | 4534271 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1709 for 32-bit Systems | 4534276 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1709 for ARM64-based Systems | 4534276 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1709 for x64-based Systems | 4534276 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1803 for 32-bit Systems | 4534293 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1803 for ARM64-based Systems | 4534293 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1803 for x64-based Systems | 4534293 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1809 for 32-bit Systems | 4534273 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1809 for ARM64-based Systems | 4534273 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1809 for x64-based Systems | 4534273 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1903 for 32-bit Systems | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1903 for ARM64-based Systems | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1903 for x64-based Systems | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1909 for 32-bit Systems | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1909 for ARM64-based Systems | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows 10 Version 1909 for x64-based Systems | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows Server 2016 | 4534271 (Security Update) |
Important | Spoofing | Yes |
| Windows Server 2016 (Server Core installation) | 4534271 (Security Update) |
Important | Spoofing | Yes |
| Windows Server 2019 | 4534273 (Security Update) |
Important | Spoofing | Yes |
| Windows Server 2019 (Server Core installation) | 4534273 (Security Update) |
Important | Spoofing | Yes |
| Windows Server, version 1803 (Server Core Installation) | 4534293 (Security Update) |
Important | Spoofing | Yes |
| Windows Server, version 1903 (Server Core installation) | 4528760 (Security Update) |
Important | Spoofing | Yes |
| Windows Server, version 1909 (Server Core installation) | 4528760 (Security Update) |
Important | Spoofing | Yes |
Patches
6 patches
| Article | Type | Restart |
|---|---|---|
4534306 |
Security Update | Yes |
4534271 |
Security Update | Yes |
4534276 |
Security Update | Yes |
4534293 |
Security Update | Yes |
4534273 |
Security Update | Yes |
4528760 |
Security Update | Yes |
Exploits & PoC
15 public PoCsUnverified third-party code
Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.
| Repository | Stars | Published | Description |
|---|---|---|---|
| ly4k/CurveBall | 889 | 2020-01-15 | PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll) |
| kudelskisecurity/chainoffools | 335 | 2020-01-15 | A PoC for CVE-2020-0601 |
| gentilkiwi/curveball | 78 | 2020-01-20 | CVE-2020-0601 #curveball - Alternative Key Calculator |
| saleemrashid/badecparams | 66 | 2020-01-16 | Proof of Concept for CVE-2020-0601 |
| 0xxon/cve-2020-0601 | 35 | 2020-01-15 | Zeek package to detect CVE-2020-0601 |
| eastmountyxz/CVE-2020-0601-EXP | 30 | 2020-02-17 | 这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，理解ECC算法、Windows验证机制，并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者，自己确实很菜，但希望坚持下去，加油！ |
| ioncodes/Curveball | 20 | 2020-01-28 | PoC for CVE-2020-0601 - CryptoAPI exploit |
| 0xxon/cve-2020-0601-plugin | 5 | 2020-01-15 | Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts |
| RrUZi/Awesome-CVE-2020-0601 | 5 | 2020-01-16 | 😂An awesome curated list of repos for CVE-2020-0601. |
| IIICTECH/-CVE-2020-0601-ECC---EXPLOIT | 3 | 2020-01-19 | CurveBall (CVE-2020-0601) - PoC CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography (ECC) is not correctly |
| nissan-sudo/CVE-2020-0601 | 2 | 2020-01-14 | Remote Code Execution Exploit |
| YoannDqr/CVE-2020-0601 | 2 | 2020-01-17 | CurveBall CVE exploitation |
| gremwell/cve-2020-0601_poc | 2 | 2020-02-18 | CVE-2020-0601 proof of concept |
| SherlockSec/CVE-2020-0601 | 1 | 2020-01-15 | A Windows Crypto Exploit |
| BlueTeamSteve/CVE-2020-0601 | 1 | 2020-01-16 | Curated list of CVE-2020-0601 resources |
Detection Rules
Detection availableCommunity detection & vulnerability-scanning rules aggregated from Sigma and Nuclei templates. Validate and tune to your environment before deploying.
Sigma rules 1
Acknowledgments
National Security Agency
References
On This Page