CVE-2020-0601

A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.

• CWE-295
• CWE-295

• https://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlThird Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlThird Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601Patch, Vendor Advisory
• https://packetstormsecurity.com/files/155960/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlThird Party Advisory, VDB Entry
• https://packetstormsecurity.com/files/155961/CurveBall-Microsoft-Windows-CryptoAPI-Spoofing-Proof-Of-Concept.htmlThird Party Advisory, VDB Entry
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601Patch, Vendor Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0601US Government Resource

Published

Jan 14, 2020

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-0595Use after free in IPv6 subsystem in Intel(R) AMT and Intel(R…9.8
• CVE-2020-0596Improper input validation in DHCPv6 subsystem in Intel(R) AM…7.5
• CVE-2020-0597Out-of-bounds read in IPv6 subsystem in Intel(R) AMT and Int…7.5
• CVE-2020-0598Uncontrolled search path in the installer for the Intel(R) B…7.8
• CVE-2020-0599Improper access control in the PMC for some Intel(R) Process…6.7
• CVE-2020-0600Improper buffer restrictions in firmware for some Intel(R) N…7.8
• CVE-2020-0602A denial of service vulnerability exists when ASP.NET Core i…7.5
• CVE-2020-0603A remote code execution vulnerability exists in ASP.NET Core…8.8
• CVE-2020-0604A remote code execution vulnerability exists in Visual Studi…7.8
• CVE-2020-0605A remote code execution vulnerability exists in .NET softwar…8.8
• CVE-2020-0606A remote code execution vulnerability exists in .NET softwar…8.8
• CVE-2020-0607An information disclosure vulnerability exists in the way th…5.5