« Volver al listado

CVE-2021-36934

Estado: AnalizadaAlta (7.8)⚠ Explotación activa

An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. An attacker must have the ability to execute code on a victim system to exploit this vulnerability.

Leer descripción completaMostrar menos

After installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ACLs permisivos en SAM permiten escalada local a SYSTEM (T1068). Logra ejecución arbitraria (T1059), creación de cuentas (T1098) y modificación de datos (T1565). Requiere ejecución previa de código (AV:L, PR:L).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Restrict File and Directory PermissionsPrivileged Account ManagementNetwork SegmentationExecution PreventionDisable or Remove Feature or ProgramUser Account Management

Tecnologías afectadas (5)

Microsoft — Windows 10 1809Microsoft — Windows 10 1909Microsoft — Windows 10 2004Microsoft — Windows 10 20h2Microsoft — Windows 10 21h1

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2021-36934",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2021-36934",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-02-04T18:15:10.079347Z"
        }
      }
    ],
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4.6,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      },
      {
        "type": "Secondary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Windows 10 Version 1809",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.17763.0",
              "lessThan": "10.0.17763.2114",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows 10 Version 1809",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "10.0.17763.2114",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "ARM64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows 10 Version 1909",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "10.0.18363.1734",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows 10 Version 2004",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "10.0.19041.1165",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems",
            "x64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows 10 Version 20H2",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "10.0.19042.1165",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems"
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Windows 10 Version 21H1",
          "versions": [
            {
              "status": "affected",
              "version": "10.0.0",
              "lessThan": "10.0.19043.1165",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems",
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2021-07-22T07:15:11.013",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36934",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://packetstormsecurity.com/files/164006/HiveNightmare-AKA-SeriousSAM.html",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36934",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.kb.cert.org/vuls/id/506989",
      "tags": [
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-36934",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.\nAn attacker must have the ability to execute code on a victim system to exploit this vulnerability.\nAfter installing this security update, you must manually delete all shadow copies of system files, including the SAM database, to fully mitigate this vulnerabilty. Simply installing this security update will not fully mitigate this vulnerability. See KB5005357- Delete Volume Shadow Copies."
    },
    {
      "lang": "es",
      "value": "Una Vulnerabilidad de Elevación de Privilegios en Windows"
    }
  ],
  "lastModified": "2026-08-10T20:19:00.610",
  "cisaActionDue": "2022-02-24",
  "cisaExploitAdd": "2022-02-10",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8D40D82-1D88-4CF1-B961-F9F28426C56B",
              "versionEndExcluding": "10.0.17763.2114"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3DD2BDE6-67C6-48E2-BED0-12E4CC7EE6BC",
              "versionEndExcluding": "10.0.18363.1734"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_2004:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70336A6A-DE45-4604-BE81-10DA4DF12D3F",
              "versionEndExcluding": "10.0.19041.1165"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7AB7321A-1F89-48B3-8E5A-94791AB2BC86",
              "versionEndExcluding": "10.0.19042.1165"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A860F2B-0533-46F7-879E-B932E4E44F0D",
              "versionEndExcluding": "10.0.19043.1165"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "cisaRequiredAction": "Apply updates per vendor instructions.",
  "cisaVulnerabilityName": "Microsoft Windows SAM Local Privilege Escalation Vulnerability"
}