CVE-2021-1675
Microsoft Windows Print Spooler Remote Code Execution Vulnerability
Description
CVE-2021-1675 is a high-severity remote code execution vulnerability in the Microsoft Windows Print Spooler service, widely known as PrintNightmare. The vulnerability allows an attacker to execute arbitrary code with SYSTEM privileges by exploiting a flaw in the Print Spooler's handling of printer driver installations. This vulnerability affects virtually all Windows versions including Windows 7, Windows 8.1, Windows 10, and multiple Windows Server editions. CISA has confirmed active exploitation and has added CVE-2021-1675 to its Known Exploited Vulnerabilities catalog. Critically, this vulnerability is known to be used in ransomware campaigns, and the EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | windows 10 1507 | < 10.0.10240.18967 |
| microsoft | windows 10 1607 | < 10.0.14393.4467 |
| microsoft | windows 10 1809 | < 10.0.17763.1999 |
| microsoft | windows 10 1909 | < 10.0.18363.1621 |
| microsoft | windows 10 2004 | < 10.0.19041.1052 |
| microsoft | windows 10 20h2 | < 10.0.19042.1052 |
| microsoft | windows 10 21h1 | < 10.0.19043.1052 |
| microsoft | windows 7 | - |
| microsoft | windows 8.1 | - |
| microsoft | windows rt 8.1 | - |
| microsoft | windows server 2004 | < 10.0.19041.1052 |
| microsoft | windows server 2008 | -; r2 |
| microsoft | windows server 2012 | -; r2 |
| microsoft | windows server 2016 | < 10.0.14393.4467 |
| microsoft | windows server 2019 | < 10.0.17763.1999 |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/163349/Microsoft-PrintNightmare-Proof-Of-Concept.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/163351/PrintNightmare-Windows-Spooler-Service-Remote-Code-Execution.html(Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/167261/Print-Spooler-Remote-DLL-Injection.html(Exploit, Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-1675(Patch, Vendor Advisory)
- https://www.kb.cert.org/vuls/id/383432(Third Party Advisory, US Government Resource)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-1675(US Government Resource)
Weakness Type
NVD-CWE-noinfo: Insufficient Information
The NVD has not assigned a specific CWE to CVE-2021-1675. The vulnerability involves improper handling of printer driver installation requests in the Windows Print Spooler service, enabling remote code execution through crafted print requests that bypass security controls.
Learn more: NVD Vulnerability Detail
Impact Analysis
CVE-2021-1675 carries a CVSS 3.1 score of 7.8 (HIGH), though the impact is amplified by its association with ransomware campaigns. The vulnerability requires local access with no privileges but needs user interaction to exploit. Confidentiality (High): successful exploitation grants SYSTEM-level access, exposing all data on the affected system. Integrity (High): an attacker can install malicious printer drivers, modify system files, and establish persistence mechanisms. Availability (High): exploitation can lead to complete system compromise, including ransomware deployment that renders systems inoperable. The EPSS score of 94.3% (99.9th percentile) indicates near-certain exploitation, and the confirmed use in ransomware campaigns makes this vulnerability an immediate priority for all organizations running Windows Print Spooler.
Exploit Maturity
CVE-2021-1675 has an extremely mature exploit landscape with widespread active exploitation. Public exploit code is available through multiple sources, including a Print Spooler Remote DLL Injection exploit on Packet Storm Security, as well as multiple proof-of-concept exploits. CISA has confirmed active exploitation in the wild, and this vulnerability is known to be used in ransomware campaigns, significantly elevating the urgency of remediation. Federal agencies were required to remediate by 2021-11-17. The EPSS score of 94.3% (99.9th percentile) reflects the near-universal exploitation of this flaw. This vulnerability is part of the broader PrintNightmare family of Print Spooler vulnerabilities.
Remediation
- Apply Microsoft security updates immediately as required by CISA KEV: Apply updates per vendor instructions. Patches are available through the Microsoft Security Response Center.
- Update all affected Windows systems to the patched versions: Windows 10 1507 (>= 10.0.10240.18967), Windows 10 1607 (>= 10.0.14393.4467), Windows 10 1809 (>= 10.0.17763.1999), Windows 10 1909 (>= 10.0.18363.1621), Windows 10 2004/20H2/21H1 (>= 10.0.19041.1052), Windows Server 2016 (>= 10.0.14393.4467), Windows Server 2019 (>= 10.0.17763.1999), and apply all available updates for Windows 7, 8.1, and Server 2008/2012.
- If patching is not immediately possible, disable the Print Spooler service on systems that do not require printing functionality using
Stop-Service -Name Spooler -Force; Set-Service -Name Spooler -StartupType Disabled. For domain controllers and other critical servers, disabling Print Spooler is strongly recommended. - Restrict inbound remote printing by configuring Group Policy to prevent remote connections to the Print Spooler service: enable "Allow Print Spooler to accept client connections" and set it to Disabled.
- Monitor systems for indicators of compromise including unexpected DLL files in the Windows Print Spooler directories, anomalous spoolsv.exe child processes, and unusual printer driver installations. Given the ransomware association, ensure offline backups are current and verified.
Technical Details
CVE-2021-1675 exploits a flaw in the Windows Print Spooler service's RpcAddPrinterDriverEx function, which handles printer driver installation requests. The vulnerability allows an attacker to supply a malicious DLL as a printer driver, which the Print Spooler service loads and executes with SYSTEM privileges. The CVSS vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates local access with no privileges required but user interaction needed, though in practice, the vulnerability has been exploited remotely in certain configurations. The attack is straightforward with low complexity, and the impact spans full compromise of confidentiality, integrity, and availability within the affected system's scope.
Frequently Asked Questions
Is CVE-2021-1675 being actively exploited?
Yes. CVE-2021-1675 is listed in the CISA Known Exploited Vulnerabilities catalog with confirmed active exploitation. This vulnerability is known to be used in ransomware campaigns. The EPSS score of 94.3% (99.9th percentile) reflects widespread exploitation activity.
What products are affected by CVE-2021-1675?
CVE-2021-1675 affects virtually all Microsoft Windows versions including Windows 7, Windows 8.1, Windows RT 8.1, Windows 10 (versions 1507, 1607, 1809, 1909, 2004, 20H2, 21H1), and Windows Server editions (2004, 2008, 2008 R2, 2012, 2012 R2, 2016, 2019).
How do I fix CVE-2021-1675?
Apply Microsoft security updates through the MSRC advisory. Update to the specified patched versions for your Windows build. If patching is not immediately possible, disable the Print Spooler service on systems that do not require printing, especially domain controllers and critical servers.
How severe is CVE-2021-1675?
CVE-2021-1675 has a CVSS 3.1 score of 7.8 (HIGH). The severity is amplified by confirmed ransomware usage and an EPSS score of 94.3% (99.9th percentile). This is a critical vulnerability that requires immediate action.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.