CVE-2021-1678
published 2021-01-12CVE-2021-1678: Windows Print Spooler Spoofing Vulnerability Windows Print Spooler Spoofing Vulnerability
high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
9.38%
94.8th percentile
Windows Print Spooler Spoofing Vulnerability
Windows Print Spooler Spoofing Vulnerability
Affected
35 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_version_1507 | >= 10.0.0 < 10.0.10240.19060 | 10.0.10240.19060 |
| microsoft | windows_10_version_1607 | >= 10.0.0 < 10.0.14393.4651 | 10.0.14393.4651 |
| microsoft | windows_10_version_1803 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2183 | 10.0.17763.2183 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.1801 | 10.0.18363.1801 |
| microsoft | windows_10_version_2004 | >= 10.0.0 < 10.0.19041.1237 | 10.0.19041.1237 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19041.1237 | 10.0.19041.1237 |
| microsoft | windows_7 | >= 6.1.0 < 6.1.7601.25712 | 6.1.7601.25712 |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < 6.1.7601.25712 | 6.1.7601.25712 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20120 | 6.3.9600.20120 |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.0.0 < 6.1.7601.25712 | 6.1.7601.25712 |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.0 < 6.1.7601.25712 | 6.1.7601.25712 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.0 < 6.0.6003.21218 | 6.0.6003.21218 |
| microsoft | windows_server_2012 | >= 6.2.0 < 6.2.9200.23462 | 6.2.9200.23462 |
| microsoft | windows_server_2012_r2 | >= 6.3.0 < 6.3.9600.20120 | 6.3.9600.20120 |
| microsoft | windows_server_2016 | >= 10.0.0 < 10.0.14393.4651 | 10.0.14393.4651 |
| microsoft | windows_server_2019 | >= 10.0.0 < 10.0.17763.2183 | 10.0.17763.2183 |
| microsoft | windows_server_version_2004 | >= 10.0.0 < 10.0.19041.1237 | 10.0.19041.1237 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19041.1237 | 10.0.19041.1237 |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1803 | — | — |
| msrc | windows_10_version_1809 | — | — |
| msrc | windows_10_version_1909 | — | — |
| msrc | windows_10_version_2004 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
yara↗
rule SentinelOne_RemotePotato0_privesc {
meta:
author = "SentinelOne"
description = "Detects RemotePotato0 binary"
reference = "https://www.sentinelone.com/wp-content/uploads/relaying-potatoes-dce-rpc-ntlm-relay-eop"
strings:
$import1 = "CoGetInstanceFromIStorage"
$istorage_clsid = "{00000306-0000-0000-c000-000000000046}" nocase wide ascii
$meow_header = { 4d 45 4f 57 }
$clsid1 = "{11111111-2222-3333-4444-555555555555}" nocase wide ascii
$clsid2 = "{5167B42F-C111-47A1-ACC4-8EABE61B0B54}" nocase wide ascii
condition:
(uint16(0) == 0x5A4D) and $import1 and $istorage_clsid and $meow_header and 1 of ($clsid*)
}bytes↗
4d 45 4f 57
- →Detect RemotePotato0 exploit tool using the published YARA rule: look for PE files importing CoGetInstanceFromIStorage, containing the IStorage CLSID {00000306-0000-0000-c000-000000000046}, the MEOW header bytes (4d 45 4f 57), and either CLSID {11111111-2222-3333-4444-555555555555} or {5167B42F-C111-47A1-ACC4-8EABE61B0B54}. ↗
- ·The IRemoteWinspool interface is only exploitable when it accepts RPC_C_AUTHN_LEVEL_CONNECT (authentication level 0x2). After the January 2021 patch, Microsoft enforces a minimum of RPC_C_AUTHN_LEVEL_PKT_INTEGRITY on this interface. Unpatched systems remain vulnerable. ↗
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
cvelistv58.8HIGH
vendor_msrc8.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CVEList
Windows Print Spooler Spoofing Vulnerability
cvelistv5·2021-01-12·CVSS 8.8
CVE-2021-1678 [HIGH] Windows Print Spooler Spoofing Vulnerability
Windows Print Spooler Spoofing Vulnerability
Windows Print Spooler Spoofing Vulnerability
Microsoft
Windows Print Spooler Spoofing Vulnerability
vendor_msrc·2021-01-12·CVSS 8.8
CVE-2021-1678 [HIGH] Windows Print Spooler Spoofing Vulnerability
Windows Print Spooler Spoofing Vulnerability
FAQ: Where can I find more information about this security update?
Please see KB4599464.
Why are there no September 2021 security updates for Windows 10 Version 1803, Windows 10 Version 1903, or Windows Server, version 1909 (Server Core installation)?
The September security updates are not available for these versions of Windows 10 and Windows Server because they are no longer in support.
Windows NTLM: Windows NTLM
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Spoofing
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5005565
Reference: https://suppo
No detection rules found.
No public exploits indexed.
Sentinelone
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol
blogs_sentinelone·2021-04-26
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol
## Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol
By Antonio Cocomazzi and Andrea Pierini
## Executive Summary
Every Windows system is vulnerable to a particular NTLM relay attack that could allow attackers to escalate privileges from User to Domain Admin.
The current status of this vulnerability is “won’t fix”.
Enterprise security teams are encouraged to follow the recommendations and mitigations given below.
## Introduction
NTLM relaying [1] is a well known technique that has long been abused by attackers. Despite the continuous “fixes” from 2001 onwards, it is still possible in a MITM scenario, for certain protocols where signing is not enabled, to intercept the NTLM messages and to “relay” the authentication to a target resource
Sentinelone
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol - SentinelLabs
blogs_sentinelone·2021-04-26
Relaying Potatoes: Another Unexpected Privilege Escalation Vulnerability in Windows RPC Protocol - SentinelLabs
By Antonio Cocomazzi and Andrea Pierini
## Executive Summary
- Every Windows system is vulnerable to a particular NTLM relay attack that could allow attackers to escalate privileges from User to Domain Admin.
- The current status of this vulnerability is “won’t fix”.
- Enterprise security teams are encouraged to follow the recommendations and mitigations given below.
## Introduction
NTLM relaying [1] is a well known technique that has long been abused by attackers. Despite the continuous “fixes” from 2001 onwards, it is still possible in a MITM scenario, for certain protocols where signing is not enabled, to intercept the NTLM messages and to “relay” the authentication to a target resource in order to elevate privileges. Normally, NTLM relays need user intervention, so you have to tric
Checkpoint
25th January – Threat Intelligence Report
blogs_checkpoint·2021-01-25
CVE-2021-1678 25th January – Threat Intelligence Report
Latest Publications
CPR Podcast Channel
AI Research
Web 3.0 Security
Intelligence Reports
ThreatCloud AI
Threat Intelligence & Research
Zero Day Protection
Sandblast File Analysis
About Us
SUBSCRIBE
2026
2025
2024
2023
2022
2021
2020
2019
2018
2017
2016
## 25th January – Threat Intelligence Report
For the latest discoveries in cyber research for the week of 25th January, please download our Threat Intelligence Bulletin .
Top Attacks and Breaches
The CHwapi hospital in Belgium has been hit by BitLocker, encrypting 40 of its servers and 100 TB of data. The attack caused the hospital to redirect patients and delay surgical procedures.
Check Point SandBlast Agent provides protection against this threat
Cybersecurity firm SonicWall has suffered an attack on its inte
Crowdstrike
What is a Zero-Day Exploit?
blogs_crowdstrike·CVSS 9.8
[CRITICAL] What is a Zero-Day Exploit?
Upcoming events
Conference
CrowdTour
Find a city near you
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Login
Login
Experienced a breach?
Contact us
## "Zero-Day" Definition
The term "Zero-Day" is used when security teams are unaware of their software vulnerability, and they’ve had “0” days to work on a security patch or an update to fix the issue. “Zero-Day” is commonly associated with the terms Vulnerability , Exploit , and Threat . It is important to understand the difference:
A Zero-Day Vulnerability is an unknown security vulnerability or software flaw that a threat actor can target with malicious code.
A Zero-Day Exploit is the technique or tactic a malicious actor uses to leverage the vulnerability to attack a
Crowdstrike
Security Advisory: MSRPC Printer Spooler Relay (CVE-2021-1678)
blogs_crowdstrike·CVSS 8.8
CVE-2026-20929 [HIGH] Security Advisory: MSRPC Printer Spooler Relay (CVE-2021-1678)
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
What is a Zero-Day Exploit?
blogs_crowdstrike
What is a Zero-Day Exploit?
Upcoming events
Conference
CrowdTour
Find a city near you
Summit
Day Zero 2026
Las Vegas, NV
Login
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Login
Experienced a breach?
Blog
Contact us
Careers
Latest Innovations
## "Zero-Day" Definition
The term "Zero-Day" is used when security teams are unaware of their software vulnerability, and they’ve had “0” days to work on a security patch or an update to fix the issue. “Zero-Day” is commonly associated with the terms Vulnerability , Exploit , and Threat . It is important to understand the difference:
A Zero-Day Vulnerability is an unknown security vulnerability or software flaw that a threat actor can target with malicious code.
A Zero-Day Exploit is the technique o
Crowdstrike
Security Advisory: MSRPC Printer Spooler Relay (CVE-2021-1678)
blogs_crowdstrike·CVSS 8.8
CVE-2026-20929 [HIGH] Security Advisory: MSRPC Printer Spooler Relay (CVE-2021-1678)
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How CrowdStrike is Accelerating Exposure Evaluation as Adversaries Gain Speed Apr 06, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand AT
Crowdstrike
NTLM Keeps Haunting Microsoft
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] NTLM Keeps Haunting Microsoft
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
Crowdstrike
What is a Zero-Day Exploit?
blogs_crowdstrike·CVSS 9.8
[CRITICAL] What is a Zero-Day Exploit?
Upcoming events
Conference
CrowdTour
Find a city near you
Login
Your Cart
Added to Cart
There's nothing in your cart
per endpoint / per year
per endpoint / per month
Login
Experienced a breach?
Contact us
## "Zero-Day" Definition
The term "Zero-Day" is used when security teams are unaware of their software vulnerability, and they’ve had “0” days to work on a security patch or an update to fix the issue. “Zero-Day” is commonly associated with the terms Vulnerability , Exploit , and Threat . It is important to understand the difference:
A Zero-Day Vulnerability is an unknown security vulnerability or software flaw that a threat actor can target with malicious code.
A Zero-Day Exploit is the technique or tactic a malicious actor uses to leverage the vulnerability to attack a
2021-01-12
Published