CVE-2017-0165

🗓️ 12 Apr 2017 14:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 2 Media mentions👁 102 Views🌐 WEB

An elevation of privilege vulnerability in Microsoft Windows

Reporter	Title	Published	Views	Family All 24
zdt	Microsoft Windows 10 10586 - IEETWCollector Arbitrary Directory/File Deletion Privilege Escalation E	20 Apr 201700:00	–	zdt
zdt	Microsoft Windows 10 (Build 10586) - IEETWCollector Arbitrary Directory/File Deletion Privilege Esca	21 Apr 201700:00	–	zdt
BDU FSTEC	The vulnerability of the Windows operating system, which allows a hacker to increase their privileges	18 May 201700:00	–	bdu_fstec
Circl	CVE-2017-0165	20 Apr 201700:00	–	circl
CNVD	Microsoft Windows Local Elevation of Privilege Vulnerability (CNVD-2017-05759)	14 Apr 201700:00	–	cnvd
Check Point Advisories	Microsoft Windows Elevation of Privilege (CVE-2017-0165)	11 Apr 201700:00	–	checkpoint_advisories
Cvelist	CVE-2017-0165	12 Apr 201714:00	–	cvelist
Exploit DB	Microsoft Windows 10 (Build 10586) - 'IEETWCollector' Arbitrary Directory/File Deletion Privilege Escalation	20 Apr 201700:00	–	exploitdb
Microsoft KB	April 11, 2017—KB4015219 (OS Build 10586.873)	11 Apr 201707:00	–	mskb
Microsoft KB	April 11, 2017—KB4015221 (OS Build 10240.17354)	11 Apr 201707:00	–	mskb

NVD

Node

microsoft windows_10

microsoft windows_10Match1511

microsoft windows_8.1

microsoft windows_rt_8.1

microsoft windows_server_2012Matchr2

[
  {
    "product": "Windows",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Windows 10, Windows 10 1511, Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2"
      }
    ]
  }
]

Source	Link
securitytracker	www.securitytracker.com/id/1038239
securityfocus	www.securityfocus.com/bid/97467
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0165
exploit-db	www.exploit-db.com/exploits/41901/

Parameter	Position	Path	Description	CWE
LogName	path	\\?\GLOBALROOT\RPC Control\xyz	PoC demonstrates using symbolic links to redirect ETW log path to an arbitrary directory, enabling deletion during cleanup by a low-integrity user.	CWE-269
LogGuid	path	\\?\GLOBALROOT\RPC Control\xyz	PoC demonstrates using symbolic links to redirect ETW log path to an arbitrary directory, enabling deletion during cleanup by a low-integrity user.	CWE-269
payload path manipulated by PoC to redirect ETW logs	path	\\?\GLOBALROOT\RPC Control\xyz	PoC demonstrates using symbolic links to redirect ETW log path to an arbitrary directory, enabling deletion during cleanup by a low-integrity user.	CWE-269

17 Jun 2026 00:57Current

7.7High risk

Vulners AI Score7.7

CVSS 27.2

CVSS 37.8

EPSS0.03338