Vulnerability record · CVE-2020-0610 · published 14 January 2020
CVE-2020-0610: Windows RD Gateway unauthenticated remote code execution
Microsoft · Windows Server 2012
Windows Remote Desktop Gateway (RD Gateway) contains a remote code execution flaw triggered when an unauthenticated attacker connects over RDP and sends specially crafted requests. It matters because the gateway is an internet-facing RDP entry point, and the flaw is distinct from the related CVE-2020-0609. The record gives no root-cause detail beyond the vendor description.
Description
A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0609.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8 with no authentication or user interaction and a very high EPSS percentile makes this a top patching priority for any exposed RD Gateway.
What it is
Windows Remote Desktop Gateway (RD Gateway) contains a remote code execution flaw triggered when an unauthenticated attacker connects over RDP and sends specially crafted requests. It matters because the gateway is an internet-facing RDP entry point, and the flaw is distinct from the related CVE-2020-0609. The record gives no root-cause detail beyond the vendor description.
Impact
An unauthenticated attacker can execute arbitrary code on the RD Gateway server, giving full control of that host and a foothold inside the network it brokers access to.
Attack surface
Reached over the network via RDP to the RD Gateway service; the CVSS vector shows no privileges and no user interaction required. Any RD Gateway exposed to untrusted networks is directly reachable.
Exploitation
Not listed in CISA KEV and no ransomware use documented, but EPSS is 0.67569 (99.3rd percentile), indicating high predicted exploitation activity. References are patch and vendor advisory only, with no public exploit tag.
What to do
- Apply the Microsoft security update for CVE-2020-0610 (and CVE-2020-0609) on all RD Gateway servers.
- Restrict RD Gateway exposure to the internet; place it behind VPN or allow-list trusted source addresses.
- Enforce MFA and network-level authentication on RDP/RD Gateway where supported.
- Monitor vendor guidance for any additional workarounds and retire unsupported Windows Server versions.
Detection
- Review RD Gateway and RDP service logs for malformed or anomalous connection attempts from untrusted sources.
- Alert on unexpected process creation or child processes spawned by the RD Gateway service.
- Baseline and monitor outbound connections from RD Gateway hosts for signs of post-exploitation.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0610 | PatchVendor Advisory |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0610 | PatchVendor Advisory |
Track CVE-2020-0610 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-0610), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
