Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2016-7237 — Improper Access Control in Microsoft Windows 10

CWE-284 — Improper Access Control6 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
63.9%
top 1.57%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
16
Microsoft Windows 10Microsoft Windows Server 2008Microsoft Windows Server 2012+13 more
Timeline
PublishedNov 10
Latest updateMay 14

Description

Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote authenticated users to cause a denial of service (system hang) via a crafted request, aka "Local Security Authority Subsystem Service Denial of Service Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages15 packages

🔴Vulnerability Details

1
GHSA
GHSA-96wx-g729-q36v: Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8↗2022-05-14
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows - LSASS SMB NTLM Exchange Null-Pointer Dereference (MS16-137)↗2016-11-09
▶

📋Vendor Advisories

1
Microsoft
Local Security Authority Subsystem Service Denial of Service Vulnerability↗2016-11-08
▶

🕵️Threat Intelligence

2
Talos
Microsoft Patch Tuesday - November 2016↗2016-11-08
▶
Talos
Microsoft Patch Tuesday - November 2016↗2016-11-08
▶