CVE-2020-0655: Windows 10 Remote Desktop Services RCE Flaw

CVE-2020-0655 Overview

CVE-2020-0655 is a remote code execution vulnerability in Microsoft Remote Desktop Services (RDS), formerly known as Terminal Services. An authenticated attacker can abuse clipboard redirection between an RDP client and server to execute arbitrary code on the target host. The flaw affects nearly all supported Windows desktop and server releases at the time of disclosure, including Windows 7, 8.1, 10, and Windows Server 2008 through 2019.

The vulnerability requires valid credentials and user interaction, but successful exploitation grants full impact on confidentiality, integrity, and availability. EPSS data places this issue in the high-probability range for observed exploitation activity.

Critical Impact

An authenticated attacker who triggers a malicious clipboard redirection sequence against a vulnerable Remote Desktop Services host can execute arbitrary code in the context of the targeted session.

Affected Products

• Microsoft Windows 7, Windows 8.1, Windows RT 8.1, and Windows 10 (versions 1607 through 1909)
• Microsoft Windows Server 2008 SP2 and Windows Server 2008 R2 SP1 (x64 and Itanium)
• Microsoft Windows Server 2012, 2012 R2, 2016 (including 1803/1903/1909), and Windows Server 2019

Discovery Timeline

• 2020-02-11 - CVE-2020-0655 published to NVD as part of Microsoft's February 2020 Patch Tuesday
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-0655

Vulnerability Analysis

The vulnerability resides in how Remote Desktop Services processes clipboard redirection between an authenticated client and the RDP server. Clipboard redirection is implemented through a virtual channel (rdpclip.exe and associated server components) that synchronizes clipboard content, including file lists and formatted data, across the session boundary.

A malformed clipboard message crafted by an authenticated client can drive the server-side handler into an unsafe code path. Because the redirection logic runs within the user's RDS session, successful exploitation results in arbitrary code execution under that session context. Microsoft did not publish granular technical details, and the vulnerability is categorized as NVD-CWE-noinfo.

Root Cause

The root cause is improper handling of clipboard data structures exchanged over the RDP CLIPRDR virtual channel. The server trusts attacker-controlled fields in clipboard redirection messages without sufficient validation, enabling memory corruption or unsafe object processing during clipboard synchronization.

Attack Vector

Exploitation requires the attacker to authenticate to a Remote Desktop Services host with valid credentials and establish an RDP session. Once connected, the attacker sends crafted clipboard redirection traffic to the server. User interaction on the target side, such as accessing the clipboard, is required to complete the exploitation chain. The attack is conducted entirely over the network through the existing RDP connection.

See the Microsoft Security Advisory CVE-2020-0655 for vendor-published details.

Detection Methods for CVE-2020-0655

Indicators of Compromise

• Unexpected child processes spawned by rdpclip.exe or other RDS session host components following clipboard activity
• Crashes or abnormal terminations of Remote Desktop Services components recorded in the Windows Application or System event logs
• RDP sessions originating from low-privilege or unexpected accounts that establish clipboard redirection channels

Detection Strategies

• Monitor process lineage for anomalous descendants of svchost.exe hosting TermService and of rdpclip.exe across user sessions
• Correlate RDP logon events (Event ID 4624 logon type 10) with subsequent process creation events on session host servers
• Inspect Microsoft-Windows-TerminalServices-RemoteConnectionManager and LocalSessionManager operational logs for unusual disconnect or reconnect patterns aligned with clipboard activity

Monitoring Recommendations

• Enable command-line and process creation auditing on all RDS session hosts and forward telemetry to a central data lake for retention and hunting
• Alert on RDP sessions from accounts that should not interactively access session hosts, particularly service or shared accounts
• Track patch state of mstscax.dll, rdpcorets.dll, and related Terminal Services binaries against the February 2020 security update baseline

How to Mitigate CVE-2020-0655

Immediate Actions Required

• Apply the February 2020 Microsoft security update for every affected Windows client and Windows Server SKU listed in the advisory
• Restrict Remote Desktop Services exposure to trusted management networks and require multi-factor authentication for RDP access
• Audit and reduce the population of accounts permitted to log on through Remote Desktop Services on each host

Patch Information

Microsoft addressed CVE-2020-0655 in the February 11, 2020 security updates. Administrators should install the cumulative update applicable to each affected Windows release as published in the Microsoft Security Advisory CVE-2020-0655. Out-of-support systems require Extended Security Updates or upgrade to a supported release.

Workarounds

• Disable clipboard redirection on Remote Desktop Session Hosts using Group Policy: Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Device and Resource Redirection > Do not allow Clipboard redirection
• Enforce Network Level Authentication (NLA) on all RDS hosts to limit pre-authentication attack surface
• Place RDS hosts behind a Remote Desktop Gateway and restrict inbound TCP 3389 from the public internet

# Disable clipboard redirection via registry on a Remote Desktop Session Host
reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" /v fDisableClip /t REG_DWORD /d 1 /f

# Restart the Terminal Services service to apply
net stop TermService /y && net start TermService