CVE-2020-1405: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability identified as CVE-2020-1405 exists in Windows Mobile Device Management (MDM) Diagnostics when it improperly handles junctions. The vulnerability was initially recorded on November 4, 2019, and was publicly disclosed in July 2020. This vulnerability affects various versions of Microsoft Windows 10, including versions 1809, 1903, and 1909 across different architectures (arm64, x64, x86) (NIST NVD, MITRE CVE).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.1 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H. Under CVSS v2.0, it received a Base Score of 3.6 (LOW) with the vector string (AV:L/AC:L/Au:N/C:N/I:P/A:P). The vulnerability requires local access and low privileges for exploitation, with no user interaction needed (NIST NVD).

If successfully exploited, this vulnerability could allow an attacker to gain elevated privileges on the affected system. The CVSS scores indicate high potential impact on integrity and availability of the system, though confidentiality impact is rated as none (NIST NVD).

The vulnerability requires local access with low attack complexity and low privileges for exploitation. No user interaction is necessary for the exploit to succeed, as indicated by the CVSS vector string (NIST NVD).

Microsoft has released security updates to address this vulnerability. Users should apply the appropriate patches through the Microsoft security advisory (Microsoft Advisory).