CVE-2021-24077
📋 TL;DR
CVE-2021-24077 is a critical remote code execution vulnerability in the Windows Fax Service that allows unauthenticated attackers to execute arbitrary code with SYSTEM privileges on affected systems. This affects Windows servers and workstations running vulnerable versions with the Fax Service enabled. Successful exploitation gives attackers complete control over the target system.
💻 Affected Systems
- Windows Server
- Windows 10
- Windows 8.1
- Windows 7
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling attackers to install malware, steal data, pivot to other systems, and maintain persistent access.
Likely Case
Ransomware deployment, data exfiltration, or creation of backdoors for persistent network access.
If Mitigated
Limited impact if Fax Service is disabled or systems are properly segmented with network controls.
🎯 Exploit Status
Exploit code is publicly available and requires no authentication. Microsoft confirmed active exploitation in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: February 2021 security updates (KB4601319, KB4601345, etc. depending on Windows version)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-24077
Restart Required: Yes
Instructions:
1. Apply February 2021 Windows security updates from Windows Update or Microsoft Update Catalog. 2. Restart affected systems. 3. Verify Fax Service is updated to patched version.
🔧 Temporary Workarounds
Disable Windows Fax Service
windowsStop and disable the Fax Service to prevent exploitation
sc stop Fax
sc config Fax start= disabled
Block Fax Service Ports
windowsBlock network access to Fax Service ports (typically TCP 2000-2001)
netsh advfirewall firewall add rule name="Block Fax Service" dir=in action=block protocol=TCP localport=2000-2001
🧯 If You Can't Patch
- Disable Windows Fax Service immediately using administrative tools or PowerShell
- Implement network segmentation to isolate systems with Fax Service from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if Fax Service is running: Get-Service Fax | Select Status, StartType. If running and system is unpatched, it's vulnerable.Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify February 2021 security updates are installed: Get-HotFix -Id KB4601319, KB4601345, or relevant KB for your Windows version.📡 Detection & Monitoring
Log Indicators:
- Event ID 7036 for Fax Service stopping/starting unexpectedly
- Windows Security logs showing process creation from Fax Service
- Application logs with Fax Service errors
Network Indicators:
- Unusual connections to TCP port 2000-2001
- Network traffic to Fax Service from unexpected sources
SIEM Query:
source="Windows Security" event_id=4688 process_name="*fax*" OR parent_process_name="*fax*"