PT-2021-3528 · Microsoft · Windows Print Spooler+1

Edwardzpeng + 4 · Published 2021-06-28 · Updated 2026-04-30 · CVE-2021-34527

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows Print Spooler (affected versions not specified)

Description The Windows Print Spooler service contains a flaw in how it handles file operations, potentially allowing a remote attacker to execute arbitrary code with SYSTEM privileges. This issue, also known as PrintNightmare, has been actively exploited. Reports indicate that attackers have leveraged this vulnerability to deploy ransomware within networks. The vulnerability is related to improper access control restrictions. While the initial exploitation may require some level of prior access, the vulnerability allows for significant system compromise. The vulnerability affects systems even after applying previous fixes, highlighting the need for continued vigilance. Tools have been developed to scan for vulnerable systems and to help mitigate the exploit, including scripts to restrict Point and Print and Remote Print functionality, and validation for User Account Control (UAC) being enabled.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Improper Privilege Management

Weakness Enumeration

CWE-264

CWE-269

Related Identifiers

BDU:2021-03578

CVE-2021-34527

MICROSOFTWINDOWSCVE2021_34527

Affected Products

Windows

Windows Print Spooler

References · 143

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/dcerpc/cve_2021_1675_printnightmare.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/dcerpc/cve_2021_1675_printnightmare.rb · Exploit
• 🔥 https://github.com/byt3bl33d3r/ItWasAllADream · Exploit
• 🔥 https://github.com/JohnHammond/CVE-2021-34527 · Exploit
• 🔥 https://github.com/nemo-wq/PrintNightmare-CVE-2021-34527 · Exploit
• 🔥 https://github.com/m8sec/CVE-2021-34527 · Exploit
• 🔥 https://github.com/hackerhouse-opensource/cve-2021-34527 · Exploit
• 🔥 https://github.com/thomas-lauer/PrintNightmare · Exploit
• 🔥 https://github.com/glshnu/PrintNightmare · Exploit
• 🔥 https://github.com/CnOxx1/CVE-2021-34527-1675 · Exploit
• 🔥 https://github.com/dywhoami/CVE-2021-34527-Scanner-Based-On-cube0x0-POC · Exploit
• 🔥 https://github.com/Tomparte/PrintNightmare · Exploit
• 🔥 https://github.com/0xirison/PrintNightmare-Patcher · Exploit
• 🔥 http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html · Exploit
• 🔥 https://vicarius.io/vsociety/posts/cve-2021-34527-printnightmare-detection-script · Exploit