CVE-2021-27070: Microsoft Windows Update Assistant Improper Access Control Privilege Escalation Vulnerability
Windows 10 Update Assistant Elevation of Privilege Vulnerability
Other sources
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windows Update Assistant. The issue results from incorrect permissions on a directory. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of Administrator.
— ZDI
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.0.19043.867Patch KB5000802
Event History
Frequently Asked Questions
What is CVE-2021-27070?
CVE-2021-27070 is a vulnerability in Microsoft Windows that allows local attackers to escalate privileges on affected installations.
What is the severity of CVE-2021-27070?
The severity of CVE-2021-27070 is critical, with a CVSS score of 7.8.
How can an attacker exploit CVE-2021-27070?
An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit CVE-2021-27070.
Which software versions are affected by CVE-2021-27070?
CVE-2021-27070 affects Microsoft Windows 10 versions 20H2 and 2004, as well as Windows Server 2016 versions 20H2 and 2004.
How can I fix CVE-2021-27070?
To fix CVE-2021-27070, apply the necessary patches provided by Microsoft, which can be found at the provided URLs.