CVE-2021-42297: Microsoft Windows Update Assistant Link Following Local Privilege Escalation Vulnerability
First published: Tue Nov 16 2021(Updated: )
This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability. The specific flaw exists within Windows Update Assistant. By creating a symbolic link, an attacker can abuse the Update Assistant to delete a folder. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM.
Credit: secure@microsoft.com secure@microsoft.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Microsoft Windows 10 Update Assistant | ||
| Microsoft Windows | ||
| Microsoft Windows Update Assistant | ||
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2021-42297?
CVE-2021-42297 is a vulnerability that allows local attackers to escalate privileges on affected installations of Microsoft Windows.
How does CVE-2021-42297 work?
CVE-2021-42297 works by exploiting a flaw within the Windows Update Assistant, where an attacker can create a symbolic link to abuse the Update Assistant.
What is the severity of CVE-2021-42297?
CVE-2021-42297 has a severity rating of 7.8, indicating it is a high-severity vulnerability.
How can I fix CVE-2021-42297?
To fix CVE-2021-42297, users should apply the necessary patches and updates provided by Microsoft.
Where can I find more information about CVE-2021-42297?
More information about CVE-2021-42297 can be found on the Microsoft Security Response Center website and the Zero Day Initiative website.
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/author
- collector/zdi-advisory
- source/ZDI
- alias/ZDI-21-1334
- alias/ZDI-CAN-14954
- alias/CVE-2021-42297
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/title
- agent/remedy
- agent/severity
- collector/msrc-cve
- source/Microsoft
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/softwarecombine
- agent/event
- agent/trending
- vendor/microsoft
- canonical/microsoft windows 10 update assistant
- canonical/microsoft windows
- canonical/microsoft windows update assistant