CVE-2020-17062: 
vulnerability analysis and mitigation

Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability (CVE-2020-17062) was disclosed on November 10, 2020. This vulnerability affects various versions of Microsoft Office products including Microsoft 365 Apps Enterprise, Office 2010 SP2, Office 2013 SP1, Office 2016, and Office 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 9.3 (HIGH) with the vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

This vulnerability could allow remote code execution if a user opens a specially crafted Office file. The successful exploitation could lead to complete compromise of confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction, as the victim must voluntarily interact with the attack mechanism. The attack complexity is considered low, requiring no privileges for exploitation (NVD).

Microsoft has released security updates to address this vulnerability. Users should apply the security update KB4484534 for Office 2010, which is available through Microsoft Update, Microsoft Update Catalog, or Microsoft Download Center (Microsoft Support).