CVE-2023-36802
📋 TL;DR
This vulnerability in Microsoft Streaming Service Proxy allows attackers to escalate privileges on affected Windows systems. An authenticated attacker could exploit this to gain SYSTEM-level privileges, potentially taking full control of the system. This affects Windows servers and workstations with the vulnerable component enabled.
💻 Affected Systems
- Microsoft Windows
📦 What is this software?
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 1809 by Microsoft
Windows 10 21h2 by Microsoft
Windows 10 22h2 by Microsoft
Windows 11 21h2 by Microsoft
Windows 11 22h2 by Microsoft
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with SYSTEM privileges, enabling installation of malware, data theft, lateral movement, and persistence establishment.
Likely Case
Privilege escalation from a standard user or service account to SYSTEM, allowing attackers to bypass security controls and execute arbitrary code.
If Mitigated
Limited impact if proper network segmentation, least privilege principles, and endpoint protection are in place, though local privilege escalation remains possible.
🎯 Exploit Status
CISA has added this to its Known Exploited Vulnerabilities catalog, indicating active exploitation. Requires authenticated access to the target system.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: July 2023 security updates (KB5028166 for Windows 10, KB5028185 for Windows 11, etc.)
Vendor Advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36802
Restart Required: Yes
Instructions:
1. Apply July 2023 Windows security updates via Windows Update. 2. For enterprise environments, deploy updates through WSUS, SCCM, or Intune. 3. Restart systems after update installation.
🔧 Temporary Workarounds
Disable Microsoft Streaming Service Proxy
windowsDisables the vulnerable service to prevent exploitation
sc config wcncsvc start= disabled
sc stop wcncsvc
🧯 If You Can't Patch
- Implement strict network segmentation to limit lateral movement
- Apply least privilege principles and monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check if system is running a vulnerable Windows version without July 2023 security updates and has wcncsvc service runningCheck Version:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"Verify Fix Applied:
Verify July 2023 security updates are installed and wcncsvc service version is updated📡 Detection & Monitoring
Log Indicators:
- Event ID 4688 with wcncsvc.exe spawning processes
- Unexpected SYSTEM privilege escalation events
- Security log entries showing service manipulation
Network Indicators:
- Unusual outbound connections from wcncsvc.exe
- Lateral movement attempts following local privilege escalation
SIEM Query:
EventID=4688 AND NewProcessName="*wcncsvc.exe*" | stats count by Computer, ParentProcessName, NewProcessName