Attacker Value
Low
(2 users assessed)
Exploitability
Very Low
(2 users assessed)
User Interaction
None
Privileges Required
Low
Attack Vector
Local
6

CVE-2021-1647 Microsoft Windows Defender Zero-Day Vulnerability

Disclosure Date: January 12, 2021 •
CVE-2021-1647 CVSS v3 Base Score: 7.8
Exploited in the Wild
Reported by ccondon-r7
View Source Details
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Initial Access
Techniques
Validation
Validated
Validated
Privilege Escalation
Techniques
Validation
Validated

Description

CVE-2021-1647 is a zero-day remote code execution vulnerability in the Malware Protection Engine component (mpengine.dll) of Microsoft’s Defender anti-virus product. It was published as part of the January 2021 Patch Tuesday release, along with a disclosure from Microsoft acknowledging that the vulnerability had been exploited in the wild. More information: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-1647

Add Assessment

3
Ratings
  • Attacker Value
    Low
  • Exploitability
    Very Low
Technical Analysis

No useful information has been published so far and most of the speculations found online are based on the CVSS 3.0 metrics found in the advisory. That said, the attack vector seems to be Local but can be exploited remotely, which means that some kind of malicious file needs to be placed locally to be scanned by Windows Defender and trigger the vulnerability. After talking about this with @smcintyre-r7 and @bwatters-r7, we can imagine that Remote means this file needs to be sent remotely somehow, for example, using a file upload in a website or an email attachment via Exchange.

Some considerations to keep in mind: Windows defender vulnerabilities get patched immediately and automatically, without user interactions. So, the exploitation window is very short. Finally, even if the exploitation succeeds, the evasion will be problematic, since the anti-virus will probably detect the attack.

Log in to Add Reply
2
Technical Analysis

Seeing more evidence of people trying to exploit this in the wild in recent days, with samples such as the ones listed at https://twitter.com/dnpushme/status/1350022293464907780 being detected as CVE-2021-1647 exploit files per VirusTotal analysis.

Log in to Add Reply
CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
Low
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Offensive Application
Unknown
Utility Class
rce
Ports
Unknown
OS
Unknown
Vulnerable Versions
Microsoft System Center Endpoint Protection
Microsoft System Center 2012 R2 Endpoint Protection
Microsoft System Center 2012 Endpoint Protection
Microsoft Security Essentials
Windows Defender on Windows 10 Version 1803 for 32-bit Systems
Windows Defender on Windows 10 Version 1803 for x64-based Systems
Windows Defender on Windows 10 Version 1803 for ARM64-based Systems
Windows Defender on Windows 10 Version 1809 for 32-bit Systems
Windows Defender on Windows 10 Version 1809 for x64-based Systems
Windows Defender on Windows 10 Version 1809 for ARM64-based Systems
Windows Defender on Windows Server 2019
Windows Defender on Windows Server 2019 (Server Core installation)
Windows Defender on Windows 10 Version 1909 for 32-bit Systems
Windows Defender on Windows 10 Version 1909 for x64-based Systems
Windows Defender on Windows 10 Version 1909 for ARM64-based Systems
Windows Defender on Windows Server, version 1909 (Server Core installation)
Windows Defender on Windows 10 Version 2004 for 32-bit Systems
Windows Defender on Windows 10 Version 2004 for ARM64-based Systems
Windows Defender on Windows 10 Version 2004 for x64-based Systems
Windows Defender on Windows Server, version 2004 (Server Core installation)
Windows Defender on Windows 10 Version 20H2 for x64-based Systems
Windows Defender on Windows 10 Version 20H2 for 32-bit Systems
Windows Defender on Windows 10 Version 20H2 for ARM64-based Systems
Windows Defender on Windows Server, version 20H2 (Server Core Installation)
Windows Defender on Windows 10 for 32-bit Systems
Windows Defender on Windows 10 for x64-based Systems
Windows Defender on Windows 10 Version 1607 for 32-bit Systems
Windows Defender on Windows 10 Version 1607 for x64-based Systems
Windows Defender on Windows Server 2016
Windows Defender on Windows Server 2016 (Server Core installation)
Windows Defender on Windows 7 for 32-bit Systems Service Pack 1
Windows Defender on Windows 7 for x64-based Systems Service Pack 1
Windows Defender on Windows 8.1 for 32-bit systems
Windows Defender on Windows 8.1 for x64-based systems
Windows Defender on Windows RT 8.1
Windows Defender on Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Defender on Windows Server 2008 for 32-bit Systems (Server Core installation) Service Pack 2
Windows Defender on Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Defender on Windows Server 2008 R2 for x64-based Systems (Server Core installation) Service Pack 1
Windows Defender on Windows Server 2012
Windows Defender on Windows Server 2012 (Server Core installation)
Windows Defender on Windows Server 2012 R2
Windows Defender on Windows Server 2012 R2 (Server Core installation)
Prerequisites
Unknown
Discovered By
Unknown
PoC Author
Unknown
Metasploit Module
Unknown
Reporter
Unknown

Vendors

  • Microsoft

Products

  • Microsoft System Center,
  • Microsoft Security Essentials,
  • Windows Defender on Windows 10 Version 1803 for 32-bit Systems,
  • Windows Defender on Windows 10 Version 1803 for x64-based Systems,
  • Windows Defender on Windows 10 Version 1803 for ARM64-based Systems,
  • Windows Defender on Windows 10 Version 1809 for 32-bit Systems,
  • Windows Defender on Windows 10 Version 1809 for x64-based Systems,
  • Windows Defender on Windows 10 Version 1809 for ARM64-based Systems,
  • Windows Defender on Windows Server 2019,
  • Windows Defender on Windows Server 2019 (Server Core installation),
  • Windows Defender on Windows 10 Version 1909 for 32-bit Systems,
  • Windows Defender on Windows 10 Version 1909 for x64-based Systems,
  • Windows Defender on Windows 10 Version 1909 for ARM64-based Systems,
  • Windows Defender on Windows Server, version 1909 (Server Core installation),
  • Windows Defender on Windows 10 Version 2004 for 32-bit Systems,
  • Windows Defender on Windows 10 Version 2004 for ARM64-based Systems,
  • Windows Defender on Windows 10 Version 2004 for x64-based Systems,
  • Windows Defender on Windows Server, version 2004 (Server Core installation),
  • Windows Defender on Windows 10 Version 20H2 for x64-based Systems,
  • Windows Defender on Windows 10 Version 20H2 for 32-bit Systems,
  • Windows Defender on Windows 10 Version 20H2 for ARM64-based Systems,
  • Windows Defender on Windows Server, version 20H2 (Server Core Installation),
  • Windows Defender on Windows 10 for 32-bit Systems,
  • Windows Defender on Windows 10 for x64-based Systems,
  • Windows Defender on Windows 10 Version 1607 for 32-bit Systems,
  • Windows Defender on Windows 10 Version 1607 for x64-based Systems,
  • Windows Defender on Windows Server 2016,
  • Windows Defender on Windows Server 2016 (Server Core installation),
  • Windows Defender on Windows 7 for 32-bit Systems,
  • Windows Defender on Windows 7 for x64-based Systems,
  • Windows Defender on Windows 8.1 for 32-bit systems,
  • Windows Defender on Windows 8.1 for x64-based systems,
  • Windows Defender on Windows RT 8.1,
  • Windows Defender on Windows Server 2008 for 32-bit Systems,
  • Windows Defender on Windows Server 2008 for 32-bit Systems (Server Core installation),
  • Windows Defender on Windows Server 2008 R2 for x64-based Systems,
  • Windows Defender on Windows Server 2008 R2 for x64-based Systems (Server Core installation),
  • Windows Defender on Windows Server 2012,
  • Windows Defender on Windows Server 2012 (Server Core installation),
  • Windows Defender on Windows Server 2012 R2,
  • Windows Defender on Windows Server 2012 R2 (Server Core installation)

Exploited in the Wild

Reported by:
Reported: January 13, 2021 12:02am UTC (5 months ago)

Additional Info

Authenticated
Unknown
Exploitable
Unknown
Reliability
Unknown
Stability
Unknown
Available Mitigations
Unknown
Shelf Life
Unknown
Userbase/Installbase
Unknown
Patch Effectiveness
Unknown
Technical Analysis