CVE-2020-16898
Windows TCP/IP Remote Code Execution Vulnerability
- Published
- Oct 16, 2020
- Updated
- Aug 4, 2024
- Assigning CNA
- microsoft
- Evidence observed
- Aug 8, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HModerate · next 30 days
- Percentile
- 95.8%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
<p>A remote code execution vulnerability exists when the Windows TCP/IP stack improperly handles ICMPv6 Router Advertisement packets. An attacker who successfully exploited this vulnerability could gain the ability to execute code on the target server or client.</p> <p>To exploit this vulnerability, an attacker would have to send specially crafted ICMPv6 Router Advertisement packets to a remote Windows computer.</p> <p>The update addresses the vulnerability by correcting how the Windows TCP/IP stack handles ICMPv6 Router Advertisement packets.</p>
Sources
PoC BSOD for CVE-2020-16898 (badneighbor)
- CVE-2020-16898Detection
CVE-2020-16898 (Bad Neighbor) Microsoft Windows TCP/IP Vulnerability Detection Logic and Rule
- CVE-2020-16898_CheckerScanner
Check all Network Interfaces for CVE-2020-16898 Vulnerability
PowerShell Script Workaround for VCE-220-16898 Vulnerability
- CVE-2020-16898--EXP-POCExploit
Proof-of-concept exploit and checker for CVE-2020-16898, a Windows TCP/IP remote code execution vulnerability. Includes Python-based exploit scripts targeting IPv6 local link addresses.
- CVE-2020-16898-EXP-POCExploit
Proof-of-concept exploit for CVE-2020-16898, a Windows TCP/IP remote code execution vulnerability. Includes Python-based exploit scripts targeting IPv6 addresses for penetration testing.
- CVE-2020-16898_CheckDetection
Minor powershell script that checks for vulnerable interfaces.
- CVE-2020-16898Detection
A network detection package for CVE-2020-16898 (Windows TCP/IP Remote Code Execution Vulnerability)
- CVE-2020-16898-Bad-NeighborDetection
Zeek detection for CVE-2020-16898-"Bad Neighbor"
PoC BSOD for CVE-2020-16898
- suricata-scriptDetection
CVE-2020-16898 — “Bad Neighbor” (ICMPv6 RDNSS length parsing) — Suricata Lua Detection
- CVE-2020-16898-expExploit
Exploit for CVE-2020-16898, a Windows TCP/IP stack remote code execution vulnerability in IPv6 source routing. Provides proof-of-concept code for security testing.
PoC Bad Neighbor BSOD exploit
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.