Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12214
HistoryJul 01, 2021 - 12:00 a.m.

KLA12214 RCE vulnerability in Microsoft Products (ESU)

2021-07-0100:00:00
Kaspersky Lab
threats.kaspersky.com
115

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.967 High

EPSS

Percentile

99.6%

JSON

Detect date:

07/01/2021

Severity:

Critical

Description:

A remote code execution vulnerability was found in Microsoft Products (Extended Support Update). Malicious users can exploit this vulnerability to execute arbitrary code.

Exploitation:

Public exploits exist for this vulnerability.

Affected products:

Windows 7 for 32-bit Systems Service Pack 1
Windows Server 2012 R2 (Server Core installation)
Windows Server 2016
Windows 10 Version 1909 for x64-based Systems
Windows 10 Version 1909 for 32-bit Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows 10 Version 21H1 for ARM64-based Systems
Windows 10 Version 2004 for 32-bit Systems
Windows Server 2012
Windows RT 8.1
Windows 10 Version 1909 for ARM64-based Systems
Windows 10 for 32-bit Systems
Windows 7 for x64-based Systems Service Pack 1
Windows 8.1 for x64-based systems
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows 10 Version 2004 for x64-based Systems
Windows 10 Version 21H1 for x64-based Systems
Windows Server 2019
Windows Server 2019 (Server Core installation)
Windows 10 Version 1809 for 32-bit Systems
Windows 10 Version 1607 for x64-based Systems
Windows 10 Version 20H2 for ARM64-based Systems
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2016 (Server Core installation)
Windows 8.1 for 32-bit systems
Windows Server 2012 (Server Core installation)
Windows 10 Version 21H1 for 32-bit Systems
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2012 R2
Windows 10 Version 1809 for ARM64-based Systems
Windows 10 Version 2004 for ARM64-based Systems
Windows 10 Version 20H2 for x64-based Systems
Windows 10 Version 1607 for 32-bit Systems
Windows 10 for x64-based Systems
Windows 10 Version 20H2 for 32-bit Systems
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server, version 2004 (Server Core installation)
Windows Server, version 20H2 (Server Core Installation)
Windows 10 Version 1809 for x64-based Systems

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-34527

Impacts:

ACE

Related products:

Microsoft Windows

CVE-IDS:

CVE-2021-345278.8Critical

KB list:

5004955
5004959
5004953
5004951

Microsoft official advisories:

References

Related

nessus 12
githubexploit 30
msrc 8
threatpost 7
ics 4
mskb 20
cisa 4
hivepro 3
thn 10
cisa_kev 1
checkpoint_advisories 1
krebs 2
kaspersky 1
kitploit 2
malwarebytes 5
pentestpartners 1
mscve 2
talosblog 2
rapid7blog 8
packetstorm 1
attackerkb 3
prion 1
securelist 5
metasploit 1
cert 1
cve 1
qualysblog 9
trellix 2
avleonov 2
nessus
nessus
KB5004946: Windows 10 1909 OOB Security Update RCE (July 2021)
2021-07-08 00:00:00
KB5004959: Windows Server 2008 OOB Security Update RCE (July 2021)
2021-07-08 00:00:00
KB5004951: Windows 7 and Windows Server 2008 R2 OOB Security Update RCE (July 2021)
2021-07-08 00:00:00
githubexploit
githubexploit
Exploit for Improper Privilege Management in Microsoft
2023-04-07 20:14:31
Exploit for Improper Privilege Management in Microsoft
2021-07-09 09:22:03
Exploit for Improper Privilege Management in Microsoft
2021-07-07 07:58:53
msrc
msrc
Out-of-Band (OOB) Security Update available for CVE-2021-34527
2021-07-06 23:36:00
Clarified Guidance for CVE-2021-34527 Windows Print Spooler Vulnerability
2021-07-09 01:00:42
Clarified Guidance for CVE-2021-34527 Windows Print Spooler Vulnerability
2021-07-08 07:00:00
threatpost
threatpost
TrickBot Gang Enters Cybercrime Elite with Fresh Affiliates
2021-10-15 18:05:29
Microsoft Releases Emergency Patch for PrintNightmare Bugs
2021-07-07 10:55:02
CISA Offers New Mitigation for PrintNightmare Bug
2021-07-02 12:21:02
ics
ics
Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability
2022-05-02 12:00:00
#StopRansomware: Vice Society
2022-09-08 12:00:00
#StopRansomware: Vice Society
2022-09-08 12:00:00
mskb
mskb
July 6, 2021—KB5004947 (OS Build 17763.2029) Out-of-band
2021-07-01 07:00:00
July 6, 2021—KB5004953 (Monthly Rollup) Out-of-band
2021-07-01 07:00:00
July 6, 2021—KB5004946 (OS Build 18363.1646) Out-of-band
2021-07-02 00:00:00
cisa
cisa
CISA Issues Emergency Directive on Microsoft Windows Print Spooler
2021-07-13 00:00:00
Russian State-Sponsored Cyber Actors Access Network Misconfigured with Default MFA Protocols
2022-03-15 00:00:00
PrintNightmare, Critical Windows Print Spooler Vulnerability
2021-06-30 00:00:00
hivepro
hivepro
Russian threat actors leveraging misconfigured multifactor authentication to exploit PrintNightmare vulnerability
2022-03-18 13:58:03
Are you a victim of the Conti Ransomware?
2021-09-23 13:47:51
Emergency patches have been released by Microsoft for PrintNightmare
2021-07-08 13:50:55
thn
thn
FBI, CISA Warn of Russian Hackers Exploiting MFA and PrintNightmare Bug
2022-03-16 13:29:00
How to Mitigate Microsoft Print Spooler Vulnerability – PrintNightmare
2021-07-08 09:32:00
Researchers Share Techniques to Uncover Anonymized Ransomware Sites on Dark Web
2022-07-05 07:06:00
cisa_kev
cisa_kev
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
2021-11-03 00:00:00
checkpoint_advisories
checkpoint_advisories
Windows Print Spooler Remote Code Execution (CVE-2021-34527)
2021-07-08 00:00:00
krebs
krebs
Microsoft Issues Emergency Patch for Windows Flaw
2021-07-07 14:34:59
Microsoft Patch Tuesday, July 2021 Edition
2021-07-13 21:41:47
kaspersky
kaspersky
KLA12213 RCE vulnerability in Microsoft Windows
2021-07-01 00:00:00
kitploit
kitploit
Invoke-PSObfuscation - An In-Depth Approach To Obfuscating The Individual Components Of A PowerShell Payload Whether You'Re On Windows Or Kali Linux
2023-03-21 11:30:00
SpoolSploit - A Collection Of Windows Print Spooler Exploits Containerized With Other Utilities For Practical Exploitation
2021-10-07 11:30:00
malwarebytes
malwarebytes
PrintNightmare 0-day can be used to take over Windows domain controllers
2021-07-01 14:08:26
UPDATED: Patch now! Emergency fix for PrintNightmare released by Microsoft
2021-07-07 14:17:31
Microsoft’s PrintNightmare continues, shrugs off Patch Tuesday fixes
2021-08-12 11:30:26
pentestpartners
pentestpartners
Black Basta ransomware
2023-06-28 05:11:34
mscve
mscve
Windows Print Spooler Remote Code Execution Vulnerability
2021-07-01 07:00:00
Windows Print Spooler Remote Code Execution Vulnerability
2021-06-08 07:00:00
talosblog
talosblog
Vice Society Leverages PrintNightmare In Ransomware Attacks
2021-08-12 16:16:46
PrintNightmare: Here’s what you need to know and Talos’ coverage
2021-07-08 13:25:03
rapid7blog
rapid7blog
Metasploit Wrap-up
2021-07-09 17:53:41
Russia-Ukraine Cybersecurity Updates
2022-03-04 14:30:00
CVE-2021-34527 (PrintNightmare): What You Need to Know
2021-06-30 18:15:59
packetstorm
packetstorm
Print Spooler Remote DLL Injection
2022-05-25 00:00:00
attackerkb
attackerkb
CVE-2021-1675
2021-06-08 00:00:00
CVE-2021-35211
2021-07-13 00:00:00
CVE-2021-34527 "PrintNightmare"
2021-07-02 00:00:00
prion
prion
Remote code execution
2021-07-02 22:15:00
securelist
securelist
Quick look at CVE-2021-1675 & CVE-2021-34527 (aka PrintNightmare)
2021-07-08 05:00:06
Kaspersky Managed Detection and Response: interesting cases
2021-12-15 10:00:42
IT threat evolution Q3 2021
2021-11-26 12:00:36
metasploit
metasploit
Print Spooler Remote DLL Injection
2022-05-16 18:56:46
cert
cert
Microsoft Windows Print Spooler allows for RCE via AddPrinterDriverEx()
2021-06-30 00:00:00
cve
cve
CVE-2021-34527
2021-07-02 22:15:00
qualysblog
qualysblog
Microsoft Windows Print Spooler RCE Vulnerability (PrintNightmare-CVE-2021-34527) – Automatically Discover, Prioritize and Remediate Using Qualys VMDR®
2021-07-07 23:30:23
Conti Ransomware
2021-11-18 17:17:56
Ransomware Insights from the FBI’s 2021 Internet Crime Report
2022-05-04 09:40:56
trellix
trellix
Beyond Memory Corruption Vulnerabilities – A Security Extinction and Future of Exploitation
2022-01-24 00:00:00
Beyond Memory Corruption Vulnerabilities – A Security Extinction and Future of Exploitation
2022-01-24 00:00:00
avleonov
avleonov
Last Week’s Security news: PrintNightmare, Kaseya, Intune, Metasploit Docker escape
2021-07-05 15:19:07
Last Week’s Security news: PrintNightmare patches and Metasploit, Kaseya CVEs, Morgan Stanley Accellion FTA, Cisco BPA and WSA, Philips Vue PACS, CISA RVAs, Lazarus job offers
2021-07-11 20:52:51

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.967 High

EPSS

Percentile

99.6%

JSON
Related for KLA12214
nessus12githubexploit30msrc8threatpost7ics4mskb20cisa4hivepro3thn10cisa_kev1checkpoint_advisories1krebs2kaspersky1kitploit2malwarebytes5pentestpartners1mscve2talosblog2rapid7blog8packetstorm1attackerkb3prion1securelist5metasploit1cert1cve1qualysblog9trellix2avleonov2