CVE-2020-1022: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1022) was identified in Microsoft Dynamics Business Central and NAV on-premises systems. The vulnerability was disclosed on April 14, 2020, affecting multiple versions of Microsoft Dynamics products including Dynamics 365 Business Central, Dynamics NAV 2013, 2015, 2016, and 2017 (NIST NVD, Microsoft Support).

The vulnerability received a CVSS v3.1 base score of 8.0 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it was rated at 6.0 (MEDIUM) with the vector (AV:N/AC:M/Au:S/C:P/I:P/A:P). The vulnerability is related to the NAVRecordState state in the affected systems (NIST NVD).

If successfully exploited, this vulnerability could allow remote code execution on affected systems. The vulnerability impacts the confidentiality, integrity, and availability of the system, with all three aspects rated as High under CVSS v3.1 scoring (NIST NVD).

The vulnerability requires network access and user interaction for successful exploitation. An attacker would need low privileges to execute the attack, though specific exploit details have not been publicly disclosed (NIST NVD).

Microsoft released security updates to address this vulnerability on April 14, 2020. The updates are available through the Microsoft Download Center for affected versions. System administrators may need to restart their systems after applying the security update, particularly if an instance of Visual Studio is being used (Microsoft Support).