9

Microsoft released an emergency patch and stated that the vulnerability is being actively exploited in the wild. All the news articles describing the RCE are implying that any internet-connected computer running Windows is at risk. This can't possibly be true, can it? My question is: does the PrintNightmare RCE (CVE-2021-34527) require a privileged position, such as a Windows user account, or at least local network access? I'm assuming regular consumer routers do not expose random ports to the internet.

3
3

All the news articles describing the RCE are implying that any internet-connected computer running Windows is at risk.

First, what you have stated here is not true.

The article that you yourself linked to does not describe the vulnerability in this way.

The US-CERT article on the vulnerability also does not describe the vulnerability in this way.

My question is: does the PrintNightmare RCE (CVE-2021-34527) require a privileged position, such as a Windows user account, or at least local network access? I'm assuming regular consumer routers do not expose random ports to the internet.

The vulnerability may exist in every unpatched Windows OS, but in order for it to be exploited the computer need to be accessible to the attacker from the network.

So, if your home Windows 10 computer is behind a home router, then that computer is not accessible from the big bad Internet in most cases (unless you have enabled port forwarding).

You are correct that most home routers do not, by default, have port forwarding enabled.

2
  • Why is it not a "news article"? It seems to be reasonably described as an "article" and it contains "news"...
    – hft
    Jul 24 at 22:18
  • Sir, this is a Wendy's
    – hft
    Jul 26 at 17:11
-1

This does affect all versions of Windows, from my understanding. As a workaround, you can stop and disable the print spooler service - until you're comfortable with a patch.

1
  • This answer is incorrect, because the vulnerability does not affect all versions of Windows (in particular, the recently patched versions should not be at risk). Furthermore, this answer does not answer the question, because it doesn't address what conditions need to be present in addition to having a vulnerable Windows version connected to the internet, e.g. does the attacker require a Windows account or a privileged network position. Jul 24 at 23:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.