CVE-2020-0601: Windows CryptoAPI ECC certificate validation spoofing flaw

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a very high EPSS score and allows spoofing of trusted code signatures, making it a high-value target for attackers.

What it is

Windows CryptoAPI (Crypt32.dll) improperly validates Elliptic Curve Cryptography certificates, allowing a spoofed code-signing certificate to be trusted. An attacker can sign a malicious executable so it appears to come from a legitimate source, undermining trust in signed code and certificates.

Impact

An attacker can make malicious files or connections appear legitimately signed or trusted, enabling code execution under a false trusted identity and potential man-in-the-middle of TLS. Integrity and confidentiality are both rated high in the CVSS vector.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but exploitation requires user interaction (UI:R), such as a victim opening or running the spoofed signed file. No authentication is needed by the attacker.

Exploitation

CVE-2020-0601 is listed in CISA KEV (added 2021-11-03) and has a very high EPSS probability (0.894, 99.8th percentile), indicating active exploitation and high likelihood. Public proof-of-concept material is referenced, and no ransomware campaign use is documented.

What to do

• Apply the Microsoft security update for CVE-2020-0601 on all affected Windows 10 and Windows Server versions as a priority.
• Update Go toolchains and applications built with affected Go crypto libraries to patched releases.
• Enforce certificate and code-signing validation controls, and restrict execution of untrusted signed binaries where feasible.
• Monitor vendor advisories and re-verify trust stores and code-signing chains after patching.

Detection

• Hunt for executables signed with certificates using unusual or attacker-controlled ECC parameters, especially self-signed or unexpected issuers.
• Alert on code-signing certificate validation events and newly trusted certificates that do not chain to known CAs.
• Review endpoint telemetry for execution of signed binaries from untrusted paths or with anomalous signer metadata.
• Correlate network TLS inspection logs for certificates with suspicious ECC curve parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.