CVE-2021-43000
📋 TL;DR
This vulnerability in Amzetta zPortal Windows zClient allows local attackers to execute arbitrary code with kernel privileges or crash the operating system via a buffer overflow in an IOCTL handler. It affects users of Amzetta zPortal Windows zClient version 3.2.8180.148 and earlier. Attackers need local access to exploit this vulnerability.
💻 Affected Systems
- Amzetta zPortal Windows zClient
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with kernel-level code execution leading to persistent backdoors, credential theft, and full control over the affected system.
Likely Case
Privilege escalation from a lower-privileged user to SYSTEM/administrator level, enabling lateral movement and further exploitation.
If Mitigated
Denial of service through OS crash if exploit attempts fail or are detected by security controls.
🎯 Exploit Status
Exploitation requires local access but the buffer overflow in kernel driver makes weaponization likely. No public PoC identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: > v3.2.8180.148
Vendor Advisory: Not provided in references
Restart Required: Yes
Instructions:
1. Contact Amzetta for updated zClient version. 2. Uninstall vulnerable version. 3. Install patched version. 4. Reboot system.
🔧 Temporary Workarounds
Restrict zClient access
windowsLimit which users can interact with the zClient driver to reduce attack surface
Disable unnecessary USB-over-Ethernet
windowsRemove or disable zClient if USB-over-Ethernet functionality is not required
sc stop "Amzetta zPortal zClient"
sc config "Amzetta zPortal zClient" start= disabled
🧯 If You Can't Patch
- Implement strict access controls to limit local user privileges
- Monitor for unusual kernel driver activity and crash events
🔍 How to Verify
Check if Vulnerable:
Check installed version of Amzetta zPortal zClient via Programs and Features or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Amzetta\zPortal\zClientCheck Version:
reg query "HKLM\SOFTWARE\Amzetta\zPortal\zClient" /v VersionVerify Fix Applied:
Verify version is > 3.2.8180.148 and test USB-over-Ethernet functionality works properly📡 Detection & Monitoring
Log Indicators:
- Windows System logs showing unexpected crashes (Event ID 41)
- Security logs showing privilege escalation attempts
- Driver load/unload events for Amzetta zClient
Network Indicators:
- Unusual local process communication with kernel drivers
SIEM Query:
EventID=1 AND (Image LIKE '%zclient%' OR ParentImage LIKE '%zclient%') OR EventID=41 AND Source='Microsoft-Windows-Kernel-Power'