Windows PKU2U Elevation of Privilege Vulnerability

The remote Windows host is missing security update 4601319.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079, CVE-2021-24084, CVE-2021-24106)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24075,     CVE-2021-24080, CVE-2021-24086, CVE-2021-24098)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24081,     CVE-2021-24083, CVE-2021-24088, CVE-2021-24091,     CVE-2021-24093, CVE-2021-24094)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1698, CVE-2021-1727, CVE-2021-1732,     CVE-2021-24096, CVE-2021-24102, CVE-2021-24103,     CVE-2021-25195)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application. (CVE-2021-1731,     CVE-2021-24082)

The remote Windows host is missing security update 4601363 or cumulative update 4601347. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when an     attacker establishes a vulnerable Netlogon secure     channel connection to a domain controller, using the     Netlogon Remote Protocol (MS-NRPC). An attacker who     successfully exploited the vulnerability could run a     specially crafted application on a device on the     network. (Enforcement mode) (CVE-2020-1472)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1727, CVE-2021-24102, CVE-2021-24103,     CVE-2021-25195)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24078,     CVE-2021-24083, CVE-2021-24088, CVE-2021-24094)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734)

The remote Windows host is missing security update 4601349 or cumulative update 4601384. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24078,     CVE-2021-24083, CVE-2021-24088, CVE-2021-24094)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1727, CVE-2021-24102, CVE-2021-24103,     CVE-2021-25195)

The remote Windows host is missing security update 4601354.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1698, CVE-2021-1727, CVE-2021-1732,     CVE-2021-24102, CVE-2021-24103, CVE-2021-25195)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086, CVE-2021-24098)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24083,     CVE-2021-24088, CVE-2021-24093, CVE-2021-24094)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079, CVE-2021-24106)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application. (CVE-2021-1731,     CVE-2021-24082)

The remote Windows host is missing security update 4601357 or cumulative update 4601348. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24078,     CVE-2021-24083, CVE-2021-24088, CVE-2021-24094)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1727, CVE-2021-24102, CVE-2021-24103,     CVE-2021-25195)

The remote Windows host is missing security update 4601345.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079, CVE-2021-24084, CVE-2021-24106)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086, CVE-2021-24098)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24078,     CVE-2021-24081, CVE-2021-24083, CVE-2021-24088,     CVE-2021-24091, CVE-2021-24093, CVE-2021-24094)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1698, CVE-2021-1727, CVE-2021-1732,     CVE-2021-24096, CVE-2021-24102, CVE-2021-24103,     CVE-2021-25195)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application. (CVE-2021-1731,     CVE-2021-24082)

The remote Windows host is missing security update 4601331.
It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1727, CVE-2021-24102, CVE-2021-24103,     CVE-2021-25195)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24081,     CVE-2021-24083, CVE-2021-24088, CVE-2021-24091,     CVE-2021-24094)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086)

The remote Windows host is missing security update 4601318.
It is, therefore, affected by multiple vulnerabilities :

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086, CVE-2021-24111)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-24082)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1727, CVE-2021-24096, CVE-2021-24102,     CVE-2021-24103, CVE-2021-25195)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24078,     CVE-2021-24081, CVE-2021-24083, CVE-2021-24088,     CVE-2021-24091, CVE-2021-24093, CVE-2021-24094)

The remote Windows host is missing security update 4601315.
It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-1698, CVE-2021-1727, CVE-2021-1732,     CVE-2021-24102, CVE-2021-24103, CVE-2021-25195)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-1734, CVE-2021-24076,     CVE-2021-24079, CVE-2021-24084, CVE-2021-24106)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-24080,     CVE-2021-24086, CVE-2021-24098)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-1722,     CVE-2021-24074, CVE-2021-24077, CVE-2021-24081,     CVE-2021-24083, CVE-2021-24088, CVE-2021-24091,     CVE-2021-24093, CVE-2021-24094)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application. (CVE-2021-1731,     CVE-2021-24082)

ID	Name	Product	Family	Severity
146345	KB4601319: Windows 10 version 2004 Feb 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146342	KB4601363: Windows 7 and Windows Server 2008 R2 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146341	KB4601349: Windows 8.1 and Windows Server 2012 R2 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146339	KB4601354: Windows 10 Version 1803 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146338	KB4601357: Windows Server 2012 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146337	KB4601345: Windows 10 Version 1809 and Windows Server 2019 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146335	KB4601331: Windows 10 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146329	KB4601318: Windows 10 Version 1607 and Windows Server 2016 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical
146326	KB4601315: Windows 10 Version 1909 February 2021 Security Update	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2021-25195

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical