CVE-2020-1509: 
vulnerability analysis and mitigation

An elevation of privilege vulnerability (CVE-2020-1509) was identified in Microsoft's Local Security Authority Subsystem Service (LSASS). The vulnerability was discovered and assigned on November 4, 2019, and was publicly disclosed on August 17, 2020. This security flaw affects multiple versions of Microsoft Windows operating systems, including Windows 10, Windows 8.1, Windows 7 SP1, Windows Server 2008, 2012, 2016, and 2019 (NVD, CVE Mitre).

The vulnerability exists when an authenticated attacker sends a specially crafted authentication request to LSASS. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 base score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) according to NVD assessment, while Microsoft rated it with a score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Under CVSS v2.0, it received a MEDIUM severity rating with a base score of 6.5 (NVD).

If successfully exploited, this vulnerability could allow a remote attacker to achieve elevation of privilege on the target system's LSASS service. This could potentially give the attacker increased privileges and control over the affected system (NVD).

The vulnerability requires an authenticated user to send a specially crafted authentication request. The attack complexity is considered Low, requiring minimal specialized access conditions or extenuating circumstances for exploitation (NVD).

Microsoft has released a security update that addresses the vulnerability by modifying how LSASS handles specially crafted authentication requests. Users are advised to apply the security patches available through the Microsoft security advisory (Microsoft Advisory).