Attacker Value
Low
(2 users assessed)
Exploitability
Very Low
(2 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
6

CVE-2021-1647 Microsoft Windows Defender Zero-Day Vulnerability

Disclosure Date: January 12, 2021
Exploited in the Wild
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Validated
Validated
Privilege Escalation
Techniques
Validation
Validated

Description

Microsoft Defender Remote Code Execution Vulnerability

Add Assessment

3
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very Low
Technical Analysis

No useful information has been published so far and most of the speculations found online are based on the CVSS 3.0 metrics found in the advisory. That said, the attack vector seems to be Local but can be exploited remotely, which means that some kind of malicious file needs to be placed locally to be scanned by Windows Defender and trigger the vulnerability. After talking about this with @smcintyre-r7 and @bwatters-r7, we can imagine that Remote means this file needs to be sent remotely somehow, for example, using a file upload in a website or an email attachment via Exchange.

Some considerations to keep in mind: Windows defender vulnerabilities get patched immediately and automatically, without user interactions. So, the exploitation window is very short. Finally, even if the exploitation succeeds, the evasion will be problematic, since the anti-virus will probably detect the attack.

2
Technical Analysis

Seeing more evidence of people trying to exploit this in the wild in recent days, with samples such as the ones listed at https://twitter.com/dnpushme/status/1350022293464907780 being detected as CVE-2021-1647 exploit files per VirusTotal analysis.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • security essentials -,
  • system center endpoint protection -,
  • system center endpoint protection 2012,
  • windows defender -

Exploited in the Wild

Reported by:

Additional Info

Technical Analysis