CVE-2022-21997
📋 TL;DR
This vulnerability allows attackers to elevate privileges on Windows systems by exploiting the Print Spooler service. Attackers could gain SYSTEM-level access on affected Windows versions. This affects Windows systems with Print Spooler enabled, which is common in enterprise environments.
💻 Affected Systems
- Windows Print Spooler
📦 What is this software?
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 10 by Microsoft
Windows 11 by Microsoft
Windows 11 by Microsoft
Windows 7 by Microsoft
Windows 7 by Microsoft
Windows 8.1 by Microsoft
Windows 8.1 by Microsoft
Windows Rt 8.1 by Microsoft
Windows Server by Microsoft
Windows Server by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of malware, data theft, and lateral movement across the network.
Likely Case
Local privilege escalation allowing attackers to bypass security controls, install persistent backdoors, and access sensitive system resources.
If Mitigated
Limited impact if Print Spooler is disabled or proper network segmentation prevents lateral movement.
🎯 Exploit Status
Requires local access or ability to execute code on target system. Multiple Print Spooler vulnerabilities have been actively exploited in the wild.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: January 2022 security updates (KB5009543 for Windows 10, KB5009557 for Windows 11, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21997
Restart Required: Yes
Instructions:
1. Apply January 2022 Windows security updates via Windows Update. 2. For enterprise: Deploy patches through WSUS or SCCM. 3. Verify installation with 'wmic qfe list' showing relevant KB.
🔧 Temporary Workarounds
Disable Print Spooler Service
windowsStops the vulnerable service entirely, preventing exploitation but disabling printing functionality
sc stop spooler
sc config spooler start= disabled
Restrict Spooler Directory Permissions
windowsModify permissions on spool directory to prevent unauthorized access
icacls C:\Windows\System32\spool\PRINTERS /deny Everyone:(OI)(CI)(DE,DC)
🧯 If You Can't Patch
- Disable Print Spooler service on non-print servers
- Implement network segmentation to isolate print servers and restrict access
🔍 How to Verify
Check if Vulnerable:
Check if Print Spooler is running and system lacks January 2022 patches: 'sc query spooler' and 'systeminfo | findstr KB5009543'Check Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify patch installation: 'wmic qfe list | findstr KB5009543' (or relevant KB for your OS version)📡 Detection & Monitoring
Log Indicators:
- Event ID 7036 (service state changes) for spooler
- Unexpected Print Spooler service restarts
- Security logs showing privilege escalation attempts
Network Indicators:
- Unexpected RPC calls to Print Spooler service (port 135, 445)
- SMB traffic to print shares from unauthorized systems
SIEM Query:
EventID=7036 AND ServiceName="Spooler" AND (State="running" OR State="stopped") | stats count by _time, Computer, State