CVE-2021-31958
📋 TL;DR
This vulnerability allows an attacker to exploit Windows NTLM authentication to elevate privileges on affected systems. It affects Windows operating systems where an attacker could gain SYSTEM-level access. This impacts all Windows users and administrators who haven't applied security updates.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, allowing full control over the Windows machine, data theft, and lateral movement within the network.
Likely Case
Local privilege escalation from a standard user account to SYSTEM privileges, enabling installation of malware, credential theft, and persistence mechanisms.
If Mitigated
Limited impact with proper network segmentation, least privilege principles, and endpoint protection that detects privilege escalation attempts.
🎯 Exploit Status
Exploitation requires local access to the system. Proof-of-concept code has been published, making weaponization likely by threat actors.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: June 2021 security updates (KB5003637 for Windows 10 2004/20H2/21H1, KB5003635 for Server 2019, KB5003690 for Server 2022)
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31958
Restart Required: Yes
Instructions:
1. Apply June 2021 Windows security updates via Windows Update. 2. For enterprise environments, deploy updates through WSUS or SCCM. 3. Restart systems after patch installation.
🔧 Temporary Workarounds
Disable NTLM authentication
windowsDisables NTLM authentication to prevent exploitation, but may break legacy applications that rely on NTLM.
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa" -Name "LmCompatibilityLevel" -Value 5
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -Name "NTLMMinClientSec" -Value 0x20080000
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\MSV1_0" -Name "RestrictSendingNTLMTraffic" -Value 2
🧯 If You Can't Patch
- Implement strict network segmentation to limit lateral movement
- Enforce least privilege principles and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if June 2021 security updates are installed via 'systeminfo' command or Windows Update history.Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify KB5003637, KB5003635, or KB5003690 is installed in Windows Update history or via 'wmic qfe list' command.📡 Detection & Monitoring
Log Indicators:
- Event ID 4624 with elevated privileges from unexpected processes
- Security log entries showing NTLM authentication anomalies
- Unexpected SYSTEM-level process creation
Network Indicators:
- Unusual NTLM authentication patterns
- Lateral movement attempts using NTLM
SIEM Query:
source="WinEventLog:Security" EventID=4624 AND (NewElevatedToken="%%1842" OR TokenElevationType="%%1938")