PT-2023-1605 · Microsoft · Windows

Andrea Pierini + 1 · Published 2023-01-10 · Updated 2026-03-07 · CVE-2023-21746

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Windows versions prior to the January 2023 Patch Tuesday

Description The issue is related to the implementation of the NT LAN Manager (NTLM) protocol in Windows operating systems, which is associated with insufficient access restrictions. Exploitation of this issue may allow an attacker to bypass security restrictions and elevate their privileges. The vulnerability allows for arbitrary file read/write and elevation of privilege. It is a type of NTLM reflection attack that targets local authentication.

Recommendations As a temporary workaround, consider disabling the NTLM protocol until a patch is available. Restrict access to the vulnerable NTLM service to minimize the risk of exploitation. Apply the January 2023 Patch Tuesday updates to resolve the issue. If you are running a version of Windows that is not patched, avoid using the NTLM protocol for authentication.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-01101

CVE-2023-21746

Affected Products

Windows

References · 32

• 🔥 https://github.com/Muhammad-Ali007/LocalPotato_CVE-2023-21746 · Exploit
• https://osv.dev/vulnerability/CVE-2023-21746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-21746 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21746 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01101 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-21746 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21746 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21746 · Vendor Advisory
• https://twitter.com/Tinolle1955/status/1730306779135766976 · Twitter Post
• https://twitter.com/acupunc28094787/status/2005063308240715925 · Twitter Post
• https://securelist.com/windows-clfs-exploits-ransomware/111560 · Note
• https://t.me/avleonovcom/1073 · Telegram Post
• https://twitter.com/7h3h4ckv157/status/1733543830845358123 · Twitter Post
• https://t.me/cybersecuritytechnologies/7732 · Telegram Post
• https://t.me/poxek/2707 · Telegram Post