Vulnerability · Published Oct 16, 2020 · Assigned by microsoft

CVE-2020-16908Windows Setup Elevation of Privilege Vulnerability

High 7.8

In plain English

A high-severity security flaw in Windows 10 Version 1803 from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).

Severity (CVSS 3.1)7.8High

Exploit odds (30 days)1.0%top 38.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An elevation of privilege vulnerability exists in Windows Setup in the way it handles directories. A locally authenticated attacker could run arbitrary code with elevated system privileges. After successfully exploiting the vulnerability, an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. The security update addresses the vulnerability by ensuring Windows Setup properly handles directories.

Affected products (as reported)

Vendor	Product	Versions
Microsoft	Windows 10 Version 1803	N/A
Microsoft	Windows 10 Version 1809	N/A
Microsoft	Windows 10 Version 1909	N/A
Microsoft	Windows 10 Version 1903 for 32-bit Systems	N/A
Microsoft	Windows 10 Version 1903 for x64-based Systems	N/A
Microsoft	Windows 10 Version 1903 for ARM64-based Systems	N/A
Microsoft	Windows 10 Version 2004	N/A

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16908 x_refsource_MISC