Zerologon (CVE-2020-1472)

Background

Zerologon is the public name for CVE-2020-1472, a vulnerability in Microsoft's Netlogon Remote Protocol (MS-NRPC), the mechanism Windows domain controllers use to authenticate computers and process functions such as user logons within an Active Directory domain. The flaw was discovered by researcher Tom Tervoort of the Dutch security firm Secura and made public in September 2020, shortly after Microsoft had shipped an initial patch. The vulnerability affected the core authentication handshake used by virtually every Windows Server domain controller then in production, from Windows Server 2008 R2 through Windows Server 2019, and a related implementation in Samba, the open-source software suite that reimplements Windows networking protocols on Linux and Unix systems.

The technical flaw

Netlogon's secure channel setup relies on an authentication scheme called ComputeNetlogonCredential, which uses AES in CFB8 (cipher feedback, 8-bit) mode. Secura's research found that Microsoft's implementation used a fixed initialization vector consisting entirely of zero bytes rather than a properly randomized one. Because of a mathematical property of AES-CFB8, encrypting an all-zero plaintext with an all-zero IV produces an all-zero ciphertext in roughly 1 out of every 256 attempts, regardless of the encryption key. An attacker could therefore repeatedly attempt to establish a Netlogon session using an all-zero client credential and, after a small number of tries, satisfy the server's authentication check without knowing any valid password or credential at all.

Once authenticated this way, an attacker with mere network access to a domain controller (no user account required) could call legitimate Netlogon RPC functions to reset the domain controller's own machine account password to a known value, effectively hijacking its identity. From there, an attacker could extract password hashes from the domain database via DCSync-style requests, including the krbtgt account hash used to forge Kerberos "golden tickets," granting persistent, domain-wide administrative control.

Disclosure and patching

Microsoft addressed the underlying flaw quietly as part of its August 11, 2020 Patch Tuesday release, assigning it the identifier CVE-2020-1472. Secura published its technical whitepaper and proof-of-concept details in mid-September 2020, at which point the severity of the bug became widely understood; independent researchers quickly released working exploit tools. Because immediately enforcing strict Netlogon authentication for all client devices risked breaking legacy or misconfigured systems, Microsoft rolled the fix out in two phases: the August 2020 update enabled enforcement for Windows devices while logging non-compliant connections, and a second update deployed in February 2021 removed the ability to disable enforcement, making secure Netlogon channels mandatory by default across the domain. The Samba project separately shipped patches (versions 4.10.18, 4.11.13, and 4.12.7) to close the same authentication bypass in its own Netlogon server implementation.

Exploitation and response

Zerologon was exploited in the wild within weeks of disclosure. Security researchers and government agencies observed the vulnerability used by financially motivated ransomware affiliates and by state-linked intrusion operations to escalate from an initial network foothold to full domain compromise. The ease of exploitation, combined with the criticality of domain controllers to enterprise networks, led the U.S. Cybersecurity and Infrastructure Security Agency to issue Emergency Directive 20-04 in September 2020, compelling federal civilian executive branch agencies to patch or otherwise mitigate the vulnerability on an expedited timeline — an unusually forceful step reserved for the most severe threats.

Legacy

Zerologon is frequently taught as a canonical example of how a small, low-level cryptographic implementation mistake (a hardcoded, non-random initialization vector) can cascade into a complete authentication bypass affecting an entire class of enterprise infrastructure. It also illustrates the trade-offs vendors face when patching authentication protocols: Microsoft's phased enforcement rollout became a template referenced in later discussions of how to balance rapid security fixes against backward compatibility in mixed-vendor networks. The vulnerability remains a standard check in penetration testing and Active Directory security hardening guidance years after disclosure.

Timeline

• 2020-08-11Microsoft ships an initial fix for the underlying Netlogon flaw as part of its August Patch Tuesday updates, assigning it CVE-2020-1472, without yet publicizing its severity.
• 2020-09Secura researcher Tom Tervoort publishes technical details and a whitepaper naming the vulnerability "Zerologon," explaining the all-zero AES-CFB8 initialization vector flaw and its impact.
• 2020-09Proof-of-concept exploit tools are published publicly and active exploitation of unpatched domain controllers is observed, including by ransomware operators and state-linked actors.
• 2020-09-18The U.S. Cybersecurity and Infrastructure Security Agency issues Emergency Directive 20-04, ordering federal civilian agencies to patch or mitigate the vulnerability immediately.
• 2021-02Microsoft deploys the second, enforcement phase update, making secure Netlogon RPC connections mandatory by default and removing the ability to disable enforcement.