CVE-2020-1466: 
vulnerability analysis and mitigation

A denial of service vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an attacker connects to the target system using RDP and sends specially crafted requests. This vulnerability, identified as CVE-2020-1466, was disclosed on August 17, 2020, and affects multiple Windows Server versions including Server 2012, Server 2012 R2, Server 2016, and Server 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H by NIST. Microsoft Corporation provided a different assessment with a CVSS score of 7.8 (HIGH) and vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

An attacker who successfully exploits this vulnerability could cause the RD Gateway service on the target system to stop responding, resulting in a denial of service condition (NVD).

To exploit this vulnerability, an attacker would need to run a specially crafted application against a server which provides RD Gateway services (NVD).

Microsoft has released an update that addresses the vulnerability by correcting how RD Gateway handles connection requests (NVD).