PT-2021-3785 · Microsoft · Windows

Harmj0Y + 3 · Published 2021-08-10 · Updated 2026-03-19 · CVE-2021-36942

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Local Security Authority (LSA) versions are affected, but specific versions are not provided in the input data.

Description A spoofing issue allows attackers to affect the system. The problem is related to the Local Security Authority (LSA) in Windows. Details about real-world incidents where this issue was exploited are not provided. Technical details about exploitation include the use of EfsRpcEncryptFileSrv to bypass the latest MS patch. The issue can be exploited through RPC, and a named pipe, such as "lsarpc", can be used. The estimated number of potentially affected devices worldwide is not available.

Recommendations No specific recommendations for resolving the issue are provided in the input data for each affected version.

Exploit

Fix

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-451

Related Identifiers

BDU:2021-04045

CVE-2021-36942

MICROSOFTWINDOWSCVE2021_36942

Affected Products

Windows

References · 29

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/dcerpc/petitpotam.rb · Exploit
• 🔥 https://kb.cert.org/vuls/id/405600 · Exploit
• https://bdu.fstec.ru/vul/2021-04045 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36942 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/ADV210003 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-36942 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36942 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/668487 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-36942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36942 · Security Note
• https://twitter.com/fletch_ai/status/1744933847060422714 · Twitter Post
• https://twitter.com/cyber_megan/status/1981219868621099196 · Twitter Post
• https://nsfocusglobal.com/insights-into-ransomware-spread-using-exchange-1-day-vulnerabilities-1-2 · Note
• https://t.me/sysadm_in_channel/3303 · Telegram Post