cbcvebase.
CVE-2021-31166
published 2021-05-11

CVE-2021-31166: HTTP Protocol Stack Remote Code Execution Vulnerability

PriorityP199critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITWEXPLOITRansomware
CISA Known Exploited Vulnerabilitydue 2022-04-27
Exploited in the wild
EPSS
99.66%
99.9th percentile
HTTP Protocol Stack Remote Code Execution Vulnerability

Affected

15 ranges
VendorProductVersion rangeFixed in
microsoftwindows_10_2004< 10.0.19041.98210.0.19041.982
microsoftwindows_10_20h2< 10.0.19042.98210.0.19042.982
microsoftwindows_10_version_2004>= 10.0.0 < 10.0.19041.98210.0.19041.982
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.98210.0.19042.982
microsoftwindows_server_2004< 10.0.19041.98210.0.19041.982
microsoftwindows_server_20h2< 10.0.19042.98210.0.19042.982
microsoftwindows_server_version_2004>= 10.0.0 < 10.0.19041.98210.0.19041.982
microsoftwindows_server_version_20h2>= 10.0.0 < 10.0.19042.98210.0.19042.982
msrcwindows_10_version_2004_for_32-bit_systems
msrcwindows_10_version_2004_for_arm64-based_systems
msrcwindows_10_version_2004_for_x64-based_systems
msrcwindows_10_version_20h2_for_32-bit_systems
msrcwindows_10_version_20h2_for_arm64-based_systems
msrcwindows_server_version_2004
msrcwindows_server_version_20h2

Detection & IOCsextracted from sources · hover to see the quote

other1010949 - Microsoft Windows HTTP Protocol Stack Remote Code Execution Vulnerability (CVE-2021-31166)
snort
57539, 57540, 57542 – 57545, 57548 - 57550
snort
57539, 57540, 57542 - 57545, 57548 - 57550
  • CVE-2021-31166 is exploitable by sending a single specially crafted packet to an HTTP server; no authentication or user interaction required — monitor for malformed/unexpected HTTP.sys-level requests on Windows HTTP servers.
  • Windows 10 client machines configured as web servers are also in scope — expand detection coverage beyond server-class systems to any Windows 10 host running HTTP.sys.
  • Any organization using HTTP.sys protocol stack should be treated as a high-priority detection target; absence of authentication requirement makes exploit attempts indistinguishable from normal unauthenticated HTTP traffic without deep packet inspection.
  • ·Snort rules 57539, 57540, 57542–57545, 57548–57550 are subject to change; Firepower/SRU customers should ensure they are running the latest ruleset update.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vulncheck9.8CRITICAL
cisa9.8CRITICAL
vendor_msrc9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.