PT-2017-10460 · Microsoft · Windows Com Aggregate Marshaler+9

Published 2017-05-09 · Updated 2026-01-27 · CVE-2017-0213

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version Windows Server 2008 SP2 and R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10 Gold, 1511, 1607, and 1703 Windows Server 2016

Description An elevation-of-privilege issue allows attackers to affect the system. The vulnerability can be exploited by running a specially crafted application. It is used by Iranian hackers, who have low hacking skills, to gain access to systems by scanning for open RDP ports and attempting to brute-force credentials. In case of success, they try to use the vulnerability to elevate privileges. The hackers primarily target systems in Russia, Japan, China, and India, taking advantage of poorly configured RDP connections due to the increased remote work caused by the pandemic.

Recommendations For Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, update to a newer version that contains a fix for this issue. As a temporary workaround, consider restricting access to the Windows COM Aggregate Marshaler to minimize the risk of exploitation. Restrict access to open RDP ports to prevent brute-force attacks. Use strong credentials and enable additional security measures to prevent unauthorized access.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2026-04574

CVE-2017-0213

Affected Products

Rdp

Windows

Windows 10

Windows 7

Windows 8.1

Windows Com Aggregate Marshaler

Windows Rt 8.1

Windows Server 2008

Windows Server 2012

Windows Server 2016

References · 30

• 🔥 https://github.com/WindowsExploits/Exploits/tree/master/CVE-2017-0213 · Exploit
• 🔥 https://github.com/zcgonvh/CVE-2017-0213 · Exploit
• 🔥 https://github.com/eonrickity/CVE-2017-0213 · Exploit
• 🔥 https://exploit-db.com/exploits/42020 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-0213 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0213 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0213 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-0213 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-0213 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-04574 · Security Note
• https://github.com/obfuscator-llvm/obfuscator · Note
• https://github.com/vzex/dog-tunnel · Note
• https://github.com/LiveMirror/pcshare · Note
• https://github.com/bitsadmin/ReVBShell · Note
• https://github.com/kufan/LViewer · Note