CVE-2020-1118
HighCVSS 8.6Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
Denial of service vulnerability in Windows TLS implementation due to improper handling of certain key exchanges. A remote unauthenticated attacker could send a specially crafted request to a system using TLS 1.2 or lower, triggering an automatic reboot.
Risk Assessment
The attack can cause system and service outages, leading to unavailability.
Recommendation
Install the security update that changes how TLS key exchange messages are validated.
Original NVD description (English source)
A denial of service vulnerability exists in the Windows implementation of Transport Layer Security (TLS) when it improperly handles certain key exchanges. An attacker who successfully exploited the vulnerability could cause a target system to stop responding. To exploit this vulnerability, a remote unauthenticated attacker could send a specially crafted request to a target system utilizing TLS 1.2 or lower, triggering the system to automatically reboot. The update addresses the vulnerability by changing the way TLS key exchange messages are validated.