Description
Windows Print Spooler Remote Code Execution Vulnerability
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Windows 10 Version 1809 | 10.0.0 – < 10.0.17763.1999 | 10.0.17763.1999 |
| Microsoft | Windows Server 2019 | 10.0.0 – < 10.0.17763.1999 | 10.0.17763.1999 |
| Microsoft | Windows Server 2019 (Server Core installation) | 10.0.0 – < 10.0.17763.1999 | 10.0.17763.1999 |
| Microsoft | Windows 10 Version 1909 | 10.0.0 – < 10.0.18363.1621 | 10.0.18363.1621 |
| Microsoft | Windows 10 Version 21H1 | 10.0.0 – < 10.0.19043.1052 | 10.0.19043.1052 |
| Microsoft | Windows 10 Version 2004 | 10.0.0 – < 10.0.19041.1052 | 10.0.19041.1052 |
| Microsoft | Windows Server version 2004 | 10.0.0 – < 10.0.19041.1052 | 10.0.19041.1052 |
| Microsoft | Windows 10 Version 20H2 | 10.0.0 – < 10.0.19042.1052 | 10.0.19042.1052 |
| Microsoft | Windows Server version 20H2 | 10.0.0 – < 10.0.19042.1052 | 10.0.19042.1052 |
| Microsoft | Windows 10 Version 1507 | 10.0.0 – < 10.0.10240.18967 | 10.0.10240.18967 |
| Microsoft | Windows 10 Version 1607 | 10.0.0 – < 10.0.14393.4467 | 10.0.14393.4467 |
| Microsoft | Windows Server 2016 | 10.0.0 – < 10.0.14393.4467 | 10.0.14393.4467 |
| Microsoft | Windows Server 2016 (Server Core installation) | 10.0.0 – < 10.0.14393.4467 | 10.0.14393.4467 |
| Microsoft | Windows 7 | 6.1.0 – < 6.1.7601.25632 | 6.1.7601.25632 |
| Microsoft | Windows 7 Service Pack 1 | 6.1.0 – < 6.1.7601.25632 | 6.1.7601.25632 |
| Microsoft | Windows 8.1 | 6.3.0 – < 6.3.9600.20045, 6.3.0 – < 6.3.9600.20044 | 6.3.9600.20045 |
| Microsoft | Windows Server 2008 Service Pack 2 | 6.0.0 – < 6.0.6003.21137 | 6.0.6003.21137 |
| Microsoft | Windows Server 2008 Service Pack 2 (Server Core installation) | 6.0.0 – < 6.0.6003.21137 | 6.0.6003.21137 |
| Microsoft | Windows Server 2008 Service Pack 2 | 6.0.0 – < 6.0.6003.21137 | 6.0.6003.21137 |
| Microsoft | Windows Server 2008 R2 Service Pack 1 | 6.1.0 – < 6.1.7601.25632 | 6.1.7601.25632 |
| Microsoft | Windows Server 2008 R2 Service Pack 1 (Server Core installation) | 6.0.0 – < 6.1.7601.25632 | 6.1.7601.25632 |
| Microsoft | Windows Server 2012 | 6.2.0 – < 6.2.9200.23372 | 6.2.9200.23372 |
| Microsoft | Windows Server 2012 (Server Core installation) | 6.2.0 – < 6.2.9200.23372 | 6.2.9200.23372 |
| Microsoft | Windows Server 2012 R2 | 6.3.0 – < 6.3.9600.20045, 6.3.0 – < 6.3.9600.20044 | 6.3.9600.20045 |
| Microsoft | Windows Server 2012 R2 (Server Core installation) | 6.3.0 – < 6.3.9600.20045, 6.3.0 – < 6.3.9600.20044 | 6.3.9600.20045 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Print Spooler Remote DLL Injection
exploit/windows/dcerpc/cve_2021_1675_printnightmare
GitHub 48 repositories · most starred shown
-
cube0x0/CVE-2021-1675 ★ 2,008 · Jun 29, 2021
C# and Impacket implementation of PrintNightmare CVE-2021-1675/CVE-2021-34527
-
calebstewart/CVE-2021-1675 ★ 1,114 · Jul 1, 2021
Pure PowerShell implementation of CVE-2021-1675 Print Spooler Local Privilege Escalation (PrintNightmare)
-
hlldz/CVE-2021-1675-LPE ★ 326 · Jul 1, 2021
Local Privilege Escalation Edition for CVE-2021-1675/CVE-2021-34527
-
ly4k/PrintNightmare ★ 215 · Sep 26, 2021
Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
-
LaresLLC/CVE-2021-1675 ★ 215 · Jun 30, 2021
CVE-2021-1675 Detection Info
-
mstxq17/CVE-2021-1675_RDL_LPE ★ 144 · Sep 1, 2021
PrintNightMare LPE提权漏洞的CS 反射加载插件。开箱即用、通过内存加载、混淆加载的驱动名称来ByPass Defender/EDR。
-
sailay1996/PrintNightmare-LPE ★ 75 · Jul 5, 2021
CVE-2021-1675 (PrintNightmare)
-
evilashz/CVE-2021-1675-LPE-EXP ★ 56 · Jul 1, 2021
PrintNightmare , Local Privilege Escalation of CVE-2021-1675 or CVE-2021-34527
-
cybersecurityworks553/CVE-2021-1675_PrintNightMare ★ 23 · Jul 1, 2021
-
JumpsecLabs/PrintNightmare ★ 20 · Jul 7, 2021
Information on the Windows Spooler vulnerability - CVE-2021-1675; CVE 2021 34527
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675
- VU#383432 third-party-advisory
- http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.html
- http://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html