CVE-2022-21928
published 2022-01-11CVE-2022-21928: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
PriorityP427medium6.4CVSS 3.1
AVPACHPRNUINSUCHIHAH
EPSS
0.66%
47.3th percentile
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19177 | 10.0.10240.19177 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.4886 | 10.0.14393.4886 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.2452 | 10.0.17763.2452 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.2452 | 10.0.17763.2452 |
| microsoft | windows_10_version_1909 | >= 10.0.0 < 10.0.18363.2037 | 10.0.18363.2037 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.1466 | 10.0.19042.1466 |
| microsoft | windows_10_version_21h1 | >= 10.0.0 < 10.0.19043.1466 | 10.0.19043.1466 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19043.1466 | 10.0.19043.1466 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.434 | 10.0.22000.434 |
| microsoft | windows_8.1 | >= 6.3.0 < 6.3.9600.20246 | 6.3.9600.20246 |
| microsoft | windows_server | — | — |
| microsoft | windows_server | — | — |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23584 | 6.2.9200.23584 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20246 | 6.3.9600.20246 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.4886 | 10.0.14393.4886 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.2452 | 10.0.17763.2452 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.469 | 10.0.20348.469 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19042.1466 | 10.0.19042.1466 |
CVSS provenance
nvdv3.16.4MEDIUMCVSS:3.1/AV:P/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_msrc6.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-cx4w-hqcr-2343: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21928 [MEDIUM] CWE-94 GHSA-cx4w-hqcr-2343: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21958, CVE-2022-21959, CVE-2022-21960, CVE-2022-21961, CVE-2022-21962, CVE-2022-21963.
GHSA
GHSA-2cf2-v5rq-8wx9: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21959 [MEDIUM] GHSA-2cf2-v5rq-8wx9: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21928, CVE-2022-21958, CVE-2022-21960, CVE-2022-21961, CVE-2022-21962, CVE-2022-21963.
GHSA
GHSA-675m-qpc9-9wr6: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21958 [MEDIUM] GHSA-675m-qpc9-9wr6: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21928, CVE-2022-21959, CVE-2022-21960, CVE-2022-21961, CVE-2022-21962, CVE-2022-21963.
GHSA
GHSA-j8q3-2728-qg7p: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21960 [MEDIUM] GHSA-j8q3-2728-qg7p: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21928, CVE-2022-21958, CVE-2022-21959, CVE-2022-21961, CVE-2022-21962, CVE-2022-21963.
GHSA
GHSA-qr54-v3fq-rf83: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21962 [MEDIUM] GHSA-qr54-v3fq-rf83: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21928, CVE-2022-21958, CVE-2022-21959, CVE-2022-21960, CVE-2022-21961, CVE-2022-21963.
GHSA
GHSA-mf8g-7q5v-hc9q: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21963 [MEDIUM] GHSA-mf8g-7q5v-hc9q: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21928, CVE-2022-21958, CVE-2022-21959, CVE-2022-21960, CVE-2022-21961, CVE-2022-21962.
GHSA
GHSA-jpj4-x5mf-66v4: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.3
CVE-2022-21892 [MEDIUM] GHSA-jpj4-x5mf-66v4: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21928, CVE-2022-21958, CVE-2022-21959, CVE-2022-21960, CVE-2022-21961, CVE-2022-21962, CVE-2022-21963.
GHSA
GHSA-rmmp-36jf-jcm8: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
ghsa_unreviewed·2022-01-12·CVSS 6.8
CVE-2022-21961 [MEDIUM] GHSA-rmmp-36jf-jcm8: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-21892, CVE-2022-21928, CVE-2022-21958, CVE-2022-21959, CVE-2022-21960, CVE-2022-21962, CVE-2022-21963.
Microsoft
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
vendor_msrc·2022-01-11·CVSS 6.3
CVE-2022-21928 [MEDIUM] Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
FAQ: According to the CVSS metric, the attack vector is physical (AV:P). What does that mean for this vulnerability?
An attacker with physical access to a vulnerable system could insert a specially crafted USB device.
Are there additional attack vectors?
This vulnerability could also be exploited through a local attack vector. An attacker authenticated as an administrator on a vulnerable system could mount a specially crafted virtual hard drive (VHD) to exploit the system. This scenario results in a lower CVSS score which is why the primary attack vector is listed as Physical in our documentation.
Windows Resilient File System (ReFS): Windows Resilient File System (ReFS)
Microsoft: Microsoft
Customer Action Requir
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2022-01-11
Published