CVE-2020-0601
Microsoft Windows CryptoAPI Spoofing Vulnerability
- Published
- Jan 14, 2020
- Updated
- Oct 21, 2025
- Assigning CNA
- microsoft
- Evidence observed
- Jan 15, 2020
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 14, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source, aka 'Windows CryptoAPI Spoofing Vulnerability'.
Sources
- cve-2020-0601-pluginDetection
Zeek package that uses OpenSSL to detect CVE-2020-0601 exploit attempts
- cve-2020-0601-utilsDetection
C++ based utility to check if certificates are trying to exploit CVE-2020-0601
- gringottsPoC
proof of concept for CVE-2020-0601
PoC for "CurveBall" CVE-2020-0601
- CVE-2020-0601Research
Curated list of CVE-2020-0601 resources
- curveballExploit
CVE-2020-0601 exploit tool that computes alternative ECC private keys from public certificates, enabling certificate spoofing via curve parameter manipulation.
Proof-of-concept exploit for CVE-2020-0601 (Windows CryptoAPI spoofing) that generates rogue CA certificates to intercept HTTPS traffic, with detailed source code explaining the elliptic curve attack.
- CurveballPoC
PoC for CVE-2020-0601 - CryptoAPI exploit
Demonstration of CVE-2020-0601 aka curveball. Based on the PoC's available at https://github.com/kudelskisecurity/chainoffools and https://github.com/ly4k/CurveBall
- chainoffoolsPoC
Proof-of-concept exploit for CVE-2020-0601 Windows CryptoAPI spoofing vulnerability, demonstrating rogue CA certificate generation using elliptic curve key manipulation.
- CurveBallPoC
PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll)
- CVE-2020-0601Detection
PowerShell script to check Windows hotfix status for CVE-2020-0601 and detect exploitation attempts. Includes XML import for ControlUp Script-Based Actions.
Proof-of-concept exploit for CVE-2020-0601 (CurveBall) demonstrating ECC certificate validation bypass to spoof trusted CA and sign arbitrary executables.
- badecparamsPoC
Proof of Concept for CVE-2020-0601
- CVE-2020-0601Exploit
A Windows Crypto Exploit
PoC for CVE-2020-0601- Windows CryptoAPI (Crypt32.dll) POC: https://github.com/ollypwn/CurveBall
- CVE-2020-0601Exploit
CurveBall CVE exploitation
- cve-2020-0601Detection
Zeek package to detect CVE-2020-0601
Proof-of-concept or exploit code targeting CVE-2020-0601, a Windows CryptoAPI spoofing vulnerability.
PoC for CVE-2020-0601 vulnerability (Code Signing)
- CVE-2020-0601-EXPExploit
这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，理解ECC算法、Windows验证机制，并尝试自己复现可执行文件签名证书和HTTPS劫持的例子。作为网络安全初学者，自己确实很菜，但希望坚持下去，加油！
Proof-of-concept exploit for CVE-2020-0601 demonstrating spoofed cryptographic key generation and code signing using OpenSSL and Ruby.
- CurveBallPoC
CVE-2020-0601: Windows CryptoAPI Vulnerability. (CurveBall/ChainOfFools)
CurveBall (CVE-2020-0601) - PoC CVE-2020-0601, or commonly referred to as CurveBall, is a vulnerability in which the signature of certificates using elliptic curve cryptography (ECC) is not correctly verified. Attackers can supply hand-rolled generators, bypassing validation, antivirus & all non-protections.
- CVE-2020-0601Exploit
Remote Code Execution Exploit
- twoplustwoPoC
Implementing CVE-2020-0601
- cve-2020-0601-PerlExploit
Perl version of recently published scripts to build ECC certificates with specific parameters re CVE-2020-0601
- curveball-plusResearch
simulation experiment of Curveball (CVE-2020-0601) attacks under ECQV implicit certificates with Windows-like verifiers
这资源是作者复现微软签字证书漏洞CVE-2020-0601，结合相关资源及文章实现。推荐大家结合作者博客，复现了该漏洞和理解恶意软件自启动劫持原理。作为网络安全初学者，自己确实很菜，但希望坚持下去，一起加油！
- exploitsExploit
exploits and proof-of-concept vulnerability demonstration files from the team at Hacker House
Oliver Lyak · windows · Jan 15, 2020
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.