cbcvebase.
CVE-2021-31201
published 2021-06-08

CVE-2021-31201: Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

PriorityP179high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2021-11-17
Exploited in the wild
EPSS
2.62%
83.7th percentile
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability

Affected

50 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10_1507< 10.0.10240.1896710.0.10240.18967
microsoftwindows_10_1607< 10.0.14393.446710.0.14393.4467
microsoftwindows_10_1809< 10.0.17763.199910.0.17763.1999
microsoftwindows_10_1909< 10.0.18363.162110.0.18363.1621
microsoftwindows_10_2004< 10.0.19041.105210.0.19041.1052
microsoftwindows_10_20h2< 10.0.19042.105210.0.19042.1052
microsoftwindows_10_21h1< 10.0.19043.105210.0.19043.1052
microsoftwindows_10_version_1507>= 10.0.0 < 10.0.10240.1896710.0.10240.18967
microsoftwindows_10_version_1607>= 10.0.0 < 10.0.14393.446710.0.14393.4467
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.199910.0.17763.1999
microsoftwindows_10_version_1909>= 10.0.0 < 10.0.18363.162110.0.18363.1621
microsoftwindows_10_version_2004>= 10.0.0 < 10.0.19041.105210.0.19041.1052
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.105210.0.19042.1052
microsoftwindows_10_version_21h1>= 10.0.0 < 10.0.19043.105210.0.19043.1052
microsoftwindows_7>= 6.1.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_7_service_pack_1>= 6.1.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.200456.3.9600.20045
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.200446.3.9600.20044
microsoftwindows_server_2004< 10.0.19041.105210.0.19041.1052
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.0.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.0 < 6.1.7601.256326.1.7601.25632
microsoftwindows_server_2008_service_pack_2>= 6.0.0 < 6.0.6003.211376.0.6003.21137
microsoftwindows_server_2012
microsoftwindows_server_2012>= 6.2.0 < 6.2.9200.233726.2.9200.23372

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2021-31201 is confirmed exploited in the wild (in-the-wild exploitation detected on both latest and older software releases), targeting Windows Cryptographic Services (Microsoft Enhanced Cryptographic Provider) for Elevation of Privilege.
  • CVE-2021-31201 is chained with Adobe CVE-2021-28550 (APSB21-29) and Microsoft CVE-2021-31199; detection should consider exploit chains involving Adobe Acrobat/Reader as an initial vector leading to Windows EoP via the Enhanced Cryptographic Provider.
  • ·The vulnerability is described as 'unspecified' in public sources; no technical details, proof-of-concept code, or specific exploit artefacts (hashes, paths, commands) are publicly disclosed, limiting the creation of precise IOCs.
  • ·Publicly Disclosed status is 'No', meaning no public technical write-up or sample has been released; detection must rely on behavioral/contextual signals (e.g., Adobe process spawning privileged child processes) rather than static signatures.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
vulncheck5.2MEDIUM
cisa7.8HIGH
vendor_msrc5.2MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.