Microsoft Windows
CVE-2020-16898 — Windows TCP/IP Remote Code Execution Vulnerability
Executive Summary
A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client. To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer. The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.
Overview
8.8
CVSS HIGH
Critical
MS Severity
Not Exploited
MS Exploit Status
Less Likely
MS Exploit Likelihood
CVSS Vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
ATTACK VECTOR
Adjacent_network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
None
SCOPE
Unchanged
CONFIDENTIALITY
High
INTEGRITY
High
AVAILABILITY
High
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 7.9
EPSS Score
0.09765
probability of exploitation in the next 30 days
0.95097 percentile - updated 2026-08-14
View on FIRST.org
Affected Products
23 affected products
| Product | KB Article | Severity | Impact | Restart Required |
|---|---|---|---|---|
| Windows 10 Version 1709 for 32-bit Systems | 4580328 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1709 for ARM64-based Systems | 4580328 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1709 for x64-based Systems | 4580328 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1803 for 32-bit Systems | 4580330 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1803 for ARM64-based Systems | 4580330 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1803 for x64-based Systems | 4580330 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1809 for 32-bit Systems | 4577668 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1809 for ARM64-based Systems | 4577668 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1809 for x64-based Systems | 4577668 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1903 for 32-bit Systems | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1903 for ARM64-based Systems | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1903 for x64-based Systems | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1909 for 32-bit Systems | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1909 for ARM64-based Systems | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 1909 for x64-based Systems | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 2004 for 32-bit Systems | 4579311 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 2004 for ARM64-based Systems | 4579311 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows 10 Version 2004 for x64-based Systems | 4579311 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server 2019 | 4577668 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server 2019 (Server Core installation) | 4577668 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server, version 1903 (Server Core installation) | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server, version 1909 (Server Core installation) | 4577671 (Security Update) |
Critical | Remote Code Execution | Yes |
| Windows Server, version 2004 (Server Core installation) | 4579311 (Security Update) |
Critical | Remote Code Execution | Yes |
Patches
5 patches
| Article | Type | Restart |
|---|---|---|
4580328 |
Security Update | Yes |
4580330 |
Security Update | Yes |
4577668 |
Security Update | Yes |
4577671 |
Security Update | Yes |
4579311 |
Security Update | Yes |
Exploits & PoC
15 public PoCsUnverified third-party code
Public proof-of-concept repositories aggregated from PoC-in-GitHub. They are not reviewed and may be incomplete, non-functional, or malicious — inspect the code before running anything.
| Repository | Stars | Published | Description |
|---|---|---|---|
| advanced-threat-research/CVE-2020-16898 | 209 | 2020-10-07 | CVE-2020-16898 (Bad Neighbor) Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule |
| ZephrFish/CVE-2020-16898 | 22 | 2020-10-14 | HoneyPoC 2.0: Proof-of-Concept (PoC) script to exploit IPv6 (CVE-2020-16898). |
| 0xeb-bp/cve-2020-16898 | 22 | 2020-10-16 | PoC BSOD for CVE-2020-16898 (badneighbor) |
| momika233/CVE-2020-16898-exp | 17 | 2020-10-17 | |
| komomon/CVE-2020-16898--EXP-POC | 12 | 2020-10-28 | CVE-2020-16898 Windows TCP/IP远程代码执行漏洞 EXP&POC |
| corelight/CVE-2020-16898 | 9 | 2020-10-14 | A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability) |
| jiansiting/cve-2020-16898 | 9 | 2020-10-17 | PoC BSOD for CVE-2020-16898 |
| komomon/CVE-2020-16898-EXP-POC | 5 | 2020-10-20 | CVE-2020-16898 Windows TCP/IP远程代码执行漏洞 EXP&POC |
| Maliek/CVE-2020-16898_Check | 2 | 2020-10-14 | Minor powershell script that checks for vulnerable interfaces. |
| initconf/CVE-2020-16898-Bad-Neighbor | 2 | 2020-10-14 | Zeek detection for CVE-2020-16898-"Bad Neighbor" |
| Q1984/CVE-2020-16898 | 1 | 2020-10-16 | PoC Bad Neighbor BSOD exploit |
| esnet-security/cve-2020-16898 | 0 | 2020-10-14 | Detects CVE-2020-16898: "Bad Neighbor" |
| CPO-EH/CVE-2020-16898_Workaround | 0 | 2020-10-17 | PowerShell Script Workaround for VCE-220-16898 Vulnerability |
| CPO-EH/CVE-2020-16898_Checker | 0 | 2020-10-17 | Check all Network Interfaces for CVE-2020-16898 Vulnerability |
| aricooper/suricata-script | 0 | 2026-06-05 | CVE-2020-16898 — “Bad Neighbor” (ICMPv6 RDNSS length parsing) — Suricata Lua Detection |
Detection Rules
No public Sigma or Nuclei detection rule has been mapped to this CVE yet. Coverage is concentrated on exploited / high-profile vulnerabilities; check SigmaHQ for updates.
Acknowledgments
Microsoft Platform Security Assurance & Vulnerability Research
References
On This Page