Zerologon (CVE-2020-1472).

A cryptographic flaw in Microsoft's Netlogon protocol that lets a network attacker reset a Domain Controller's machine password and seize Active Directory. It belongs to the Vulnerabilities category of cybersecurity.

A cryptographic flaw in Microsoft's Netlogon protocol that lets a network attacker reset a Domain Controller's machine password and seize Active Directory.

Zerologon, tracked as CVE-2020-1472, is a critical Elevation-of-Privilege vulnerability in Microsoft Netlogon Remote Protocol disclosed by Secura in August 2020. The bug stems from the misuse of AES-CFB8 with an all-zero IV during Netlogon authentication, letting an attacker on the corporate network impersonate any domain-joined computer, including a Domain Controller. By repeatedly sending forged authentication attempts, an attacker can reset the DC's machine account password to an empty value, then dump credentials and obtain Domain Admin in minutes. CISA issued an emergency directive and Microsoft released a phased patch enforcing secure RPC by February 2021. Ransomware and APT groups exploited Zerologon extensively against unpatched networks.

Defences for Zerologon (CVE-2020-1472) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVE-2020-1472, Netlogon EoP.