CVE-2021-1695
📋 TL;DR
CVE-2021-1695 is an elevation of privilege vulnerability in the Windows Print Spooler service that allows authenticated attackers to execute arbitrary code with SYSTEM privileges. This affects Windows systems with the Print Spooler service enabled, which is typically running by default on Windows workstations and servers.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attackers gain SYSTEM privileges, enabling them to install programs, view/change/delete data, create new accounts, and establish persistence.
Likely Case
Local privilege escalation from a standard user account to SYSTEM privileges, allowing attackers to bypass security controls and access sensitive system resources.
If Mitigated
Limited impact with proper network segmentation, least privilege principles, and Print Spooler service disabled on non-essential systems.
🎯 Exploit Status
Exploitation requires local authenticated access. Multiple proof-of-concept exploits have been published, and the vulnerability has been actively exploited in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: January 2021 security updates (KB4598242, KB4598229, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1695
Restart Required: Yes
Instructions:
1. Apply the January 2021 Windows security updates from Microsoft Update. 2. For enterprise environments, deploy updates through WSUS or SCCM. 3. Restart affected systems to complete the installation.
🔧 Temporary Workarounds
Disable Print Spooler Service
windowsStops the vulnerable service from running, preventing exploitation but disabling printing functionality
sc stop spooler
sc config spooler start= disabled
Restrict Spooler Directory Permissions
windowsModify permissions on the spool directory to prevent unauthorized access
icacls C:\Windows\System32\spool /deny Everyone:(OI)(CI)(DE)
🧯 If You Can't Patch
- Disable Print Spooler service on all non-essential systems using Group Policy or manual configuration
- Implement network segmentation to isolate systems with Print Spooler enabled and restrict RPC access
🔍 How to Verify
Check if Vulnerable:
Check if Print Spooler service is running: 'sc query spooler' and verify Windows version is affectedCheck Version:
wmic os get caption, version, buildnumberVerify Fix Applied:
Verify January 2021 security updates are installed: 'wmic qfe list | findstr KB4598242' or check installed updates in Control Panel📡 Detection & Monitoring
Log Indicators:
- Event ID 7036 for Print Spooler service stopping/starting unexpectedly
- Security logs showing privilege escalation attempts
- Process creation events for spoolsv.exe with unusual parent processes
Network Indicators:
- Unusual RPC traffic to port 135 or named pipes related to printing services
- SMB connections to spooler shares from unauthorized systems
SIEM Query:
EventID=7036 AND ServiceName="Spooler" OR ProcessName="spoolsv.exe" AND ParentProcessName NOT IN ("services.exe", "svchost.exe")