cbcvebase.
CVE-2021-43217
published 2021-12-15

CVE-2021-43217: Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

PriorityP262critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
6.42%
92.9th percentile
Windows Encrypting File System (EFS) Remote Code Execution Vulnerability

Affected

51 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10
microsoftwindows_10_version_1507>= 10.0.0 < 10.0.10240.1914510.0.10240.19145
microsoftwindows_10_version_1607>= 10.0.0 < 10.0.14393.482510.0.14393.4825
microsoftwindows_10_version_1809>= 10.0.0 < 10.0.17763.236610.0.17763.2366
microsoftwindows_10_version_1909>= 10.0.0 < 10.0.18363.197710.0.18363.1977
microsoftwindows_10_version_2004>= 10.0.0 < 10.0.19041.141510.0.19041.1415
microsoftwindows_10_version_20h2>= 10.0.0 < 10.0.19042.141510.0.19042.1415
microsoftwindows_10_version_21h1>= 10.0.0 < 10.0.19043.141510.0.19043.1415
microsoftwindows_10_version_21h2>= 10.0.0 < 10.0.19044.141510.0.19044.1415
microsoftwindows_11_version_21h2>= 10.0.0 < 10.0.22000.37610.0.22000.376
microsoftwindows_7>= 6.1.0 < 6.1.7601.257966.1.7601.25796
microsoftwindows_7_service_pack_1>= 6.1.0 < 6.1.7601.257966.1.7601.25796
microsoftwindows_8.1>= 6.3.0 < 6.3.9600.202076.3.9600.20207
microsoftwindows_server
microsoftwindows_server
microsoftwindows_server_2008
microsoftwindows_server_2008_r2_service_pack_1>= 6.0.0 < 6.1.7601.257966.1.7601.25796
microsoftwindows_server_2008_r2_service_pack_1>= 6.1.0 < 6.1.7601.257966.1.7601.25796
microsoftwindows_server_2008_service_pack_2>= 6.0.0 < 6.0.6003.213096.0.6003.21309
microsoftwindows_server_2012

Detection & IOCsextracted from sources · hover to see the quote

  • Detect EFS client connections that lack packet-level privacy — CVE-2021-43217 exploits the absence of packet-level privacy on EFS connections to trigger a buffer overflow write leading to unauthenticated non-sandboxed code execution.
  • Audit the presence of the AllowAllCliAuth registry key — its existence may indicate a weakened EFS server configuration susceptible to exploitation; it is removed in the enforcement phase.
  • ·The two-phase rollout means unpatched or partially patched environments (only client or only server updated) remain at risk; Microsoft recommends patching client machines first, then servers.
  • ·During the initial phase (December 14, 2021 updates), the AllowAllCliAuth registry key can still be used to allow non-packet-level-privacy connections on servers, leaving a configuration gap until the Q1 2022 enforcement phase.

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
vendor_msrc8.1HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.