CVE-2020-16975: 
vulnerability analysis and mitigation

CVE-2020-16975 is a Windows Backup Service Elevation of Privilege Vulnerability that was disclosed on October 13, 2020. The vulnerability exists when the Windows Backup Service improperly handles file operations, affecting various versions of Microsoft Windows operating systems (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability requires local access, low attack complexity, low privileges, and no user interaction to exploit. The vulnerability can potentially lead to high impacts on confidentiality, integrity, and availability (NVD).

If successfully exploited, this vulnerability allows an attacker to elevate their privileges on the affected system. The attacker could then run specially crafted applications with elevated privileges, potentially gaining greater access to system resources and sensitive data (CVE).

To exploit this vulnerability, an attacker would first need to gain execution access on the target system. Once this initial access is obtained, the attacker could run a specially crafted application to elevate their privileges (Rapid7).

Microsoft has released security updates to address this vulnerability by correcting how the Windows Backup Service handles file operations. The fix is available through various KB updates including KB4580327, KB4580346, KB4580328, KB4580330, KB4577668, KB4577671, KB4579311 for different versions of Windows (Rapid7).