CVE-2021-1675highbajo ataqueransomware

CVE-2021-1675: fallo de gravedad alta en Microsoft Windows 10 Version 1507

Windows Print Spooler Remote Code Execution Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Windows Server+ Monitorear Windows

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 7.8epss 85%
de la publicación al arma21 días
Publicada en NVD8 jun
1ª PoC+21d
metasploit8 jun
CISA KEV+148d
Acción exigida por CISAplazo federal: 2021-11-17

Apply updates per vendor instructions.

En resumen

Una vulnerabilidad en el Servicio de Cola de Impresión de Windows permite que atacantes ejecuten código malicioso remotamente en una computadora sin necesidad de permisos especiales. Un atacante puede explotar esto enviando solicitudes especialmente diseñadas al servicio de impresión, potencialmente tomando control total del sistema afectado.

Detalle técnico

El servicio Windows Print Spooler no valida adecuadamente las solicitudes del cliente, permitiendo ejecución remota de código no autenticada a través de la interfaz RPC. Un atacante puede enviar un trabajo de impresión malicioso o llamada RPC que dispare ejecución de código arbitrario con privilegios SYSTEM, requiriendo solo acceso de red al puerto 445 o puertos similares de servicio de impresión.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

Windows Print Spooler Remote Code Execution Vulnerability
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Productos afectados
Microsoft · Windows 10 Version 1507Microsoft · Windows 10 Version 1607Microsoft · Windows 10 Version 1809Microsoft · Windows 10 Version 1909Microsoft · Windows 10 Version 2004Microsoft · Windows 10 Version 20H2Microsoft · Windows 10 Version 21H1Microsoft · Windows 7Microsoft · Windows 7 Service Pack 1Microsoft · Windows 8.1Microsoft · Windows Server 2008 R2 Service Pack 1Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)Microsoft · Windows Server 2008 Service Pack 2Microsoft · Windows Server 2008 Service Pack 2Microsoft · Windows Server 2008 Service Pack 2 (Server Core installation)Microsoft · Windows Server 2012Microsoft · Windows Server 2012 R2Microsoft · Windows Server 2012 R2 (Server Core installation)Microsoft · Windows Server 2012 (Server Core installation)Microsoft · Windows Server 2016Microsoft · Windows Server 2016 (Server Core installation)Microsoft · Windows Server 2019Microsoft · Windows Server 2019 (Server Core installation)Microsoft · Windows Server version 2004Microsoft · Windows Server version 20H2
PoCs públicas encontradas — 87
githubgithub.com/cube0x0/CVE-2021-1675★ 1990githubgithub.com/calebstewart/CVE-2021-1675★ 1100githubgithub.com/hlldz/CVE-2021-1675-LPE★ 325githubgithub.com/LaresLLC/CVE-2021-1675★ 214githubgithub.com/ly4k/PrintNightmare★ 209githubgithub.com/mstxq17/CVE-2021-1675_RDL_LPE★ 145githubgithub.com/sailay1996/PrintNightmare-LPE★ 77githubgithub.com/evilashz/CVE-2021-1675-LPE-EXP★ 56githubgithub.com/cybersecurityworks553/CVE-2021-1675_PrintNightMare★ 23githubgithub.com/JumpsecLabs/PrintNightmare★ 19githubgithub.com/eversinc33/NimNightmare★ 18githubgithub.com/k8gege/cve-2021-1675★ 15githubgithub.com/Wra7h/SharpPN★ 10githubgithub.com/Leonidus0x10/CVE-2021-1675-SCANNER★ 9githubgithub.com/corelight/CVE-2021-1675★ 9githubgithub.com/exploitblizzard/PrintNightmare-CVE-2021-1675★ 5githubgithub.com/thomasgeens/CVE-2021-1675★ 3githubgithub.com/hahaleyile/my-CVE-2021-1675★ 3githubgithub.com/yu2u/CVE-2021-1675★ 2githubgithub.com/killtr0/CVE-2021-1675-PrintNightmare★ 2githubgithub.com/ozergoker/PrintNightmare★ 2githubgithub.com/bartimusprimed/CVE-2021-1675-Yara★ 2githubgithub.com/kondah/patch-cve-2021-1675★ 2githubgithub.com/DLL00P/CVE-2021-1675★ 1githubgithub.com/puckiestyle/CVE-2021-1675★ 1githubgithub.com/OppressionBreedsResistance/CVE-2021-1675-PrintNightmare★ 1githubgithub.com/peckre/PNCVE-Win10-20H2-Exploit★ 1githubgithub.com/Winter3un/CVE-2021-1675★ 1githubgithub.com/whoami-chmod777/CVE-2021-1675-CVE-2021-34527★ 1githubgithub.com/initconf/cve-2021-1675-printnightmare★ 0githubgithub.com/tanarchytan/CVE-2021-1675★ 0githubgithub.com/mrezqi/CVE-2021-1675_CarbonBlack_HuntingQuery★ 0githubgithub.com/kougyokugentou/CVE-2021-1675★ 0githubgithub.com/ptter23/CVE-2021-1675★ 0githubgithub.com/edsonjt81/CVE-2021-1675★ 0githubgithub.com/galoget/PrintNightmare-CVE-2021-1675-CVE-2021-34527★ 0githubgithub.com/thalpius/microsoft-cve-2021-1675★ 0githubgithub.com/zha0/Microsoft-CVE-2021-1675★ 0githubgithub.com/r1skkam/PrintNightmare★ 0githubgithub.com/000Tonio/cve-2021-1675★ 0githubgithub.com/CameraShutterBug/PrintNightmare★ 0githubgithub.com/ccordeiro/CVE-2021-1675★ 0githubgithub.com/whoami-chmod777/CVE-2021-1675---PrintNightmare-LPE-PowerShell-★ 0githubgithub.com/0xSs0rZ/Windows_Exploit★ 0githubgithub.com/Sp4ceDogy/NPE-CS-V-CVE-2021-1675★ 0vulncheckvulncheck.com/xdb/4e7a1ede0f4cno verificadovulncheckvulncheck.com/xdb/174100d1f234no verificadocve_referencepacketstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/b45e0ec89fbbno verificadovulncheckvulncheck.com/xdb/d9dd26a5e43dno verificadovulncheckvulncheck.com/xdb/cd6c3b06a60cno verificadovulncheckvulncheck.com/xdb/b93501b21b35no verificadovulncheckvulncheck.com/xdb/ea76e3b517dano verificadovulncheckvulncheck.com/xdb/22ddb70101f9no verificadovulncheckvulncheck.com/xdb/7cc2f4d6f2d5no verificadovulncheckvulncheck.com/xdb/490a73431a10no verificadovulncheckvulncheck.com/xdb/29f9009b9be9no verificadovulncheckvulncheck.com/xdb/d01d428e5b4cno verificadovulncheckvulncheck.com/xdb/3d814c23dd9dno verificadovulncheckvulncheck.com/xdb/ded60e94a061no verificadovulncheckvulncheck.com/xdb/a272e3e91f3ano verificadovulncheckvulncheck.com/xdb/613d6b9bd25fno verificadovulncheckvulncheck.com/xdb/60402fe4962cno verificadovulncheckvulncheck.com/xdb/a3f29455981bno verificadovulncheckvulncheck.com/xdb/ddf90bbea093no verificadovulncheckvulncheck.com/xdb/dcea18151317no verificadovulncheckvulncheck.com/xdb/0c06ba53c498no verificadovulncheckvulncheck.com/xdb/b90c284dc523no verificadovulncheckvulncheck.com/xdb/462712fb0096no verificadovulncheckvulncheck.com/xdb/0d51bca37337no verificadovulncheckvulncheck.com/xdb/a45b8faa5940no verificadovulncheckvulncheck.com/xdb/0300146c83c2no verificadovulncheckvulncheck.com/xdb/da0d5a88e5dbno verificadovulncheckvulncheck.com/xdb/97af0436c96dno verificadovulncheckvulncheck.com/xdb/132e026d2027no verificadovulncheckvulncheck.com/xdb/debfb4d8ee62no verificadovulncheckvulncheck.com/xdb/381c98d00dfcno verificadovulncheckvulncheck.com/xdb/6365096d731bno verificadovulncheckvulncheck.com/xdb/a80f7a9e25f2no verificadovulncheckvulncheck.com/xdb/ffee1c151af9no verificadovulncheckvulncheck.com/xdb/5761c571065dno verificadovulncheckvulncheck.com/xdb/fd141cadfdd9no verificadocve_referencepacketstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.htmlno verificadocve_referencepacketstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.htmlno verificadovulncheckvulncheck.com/xdb/b2ee9973a014no verificadovulncheckvulncheck.com/xdb/35c8e00c7814no verificadovulncheckvulncheck.com/xdb/3367f5a15c3eno verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Microsoft Windows 10 Version 1507

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEVCVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 99.4%KEVCVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEVCVE-2022-30190HIGHMicrosoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityEPSS 99.2%KEVCVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.8%KEVCVE-2023-36025HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 88.2%KEV