{"vulnerability": "CVE-2021-37852", "sightings": [{"uuid": "c93547af-b668-491c-82b5-9161f0b92d8c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37852", "type": "exploited", "source": "https://t.me/true_secator/2588", "content": "\u041f\u043e\u0434\u044a\u0435\u0445\u0430\u043b\u0430 \u043f\u043e\u0440\u0446\u0438\u044f \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0439 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0439, \u043a\u0442\u043e \u043f\u0440\u0438\u0437\u0432\u0430\u043d \u0437\u0430\u0449\u0438\u0449\u0430\u0442\u044c \u0441\u043f\u043e\u043a\u043e\u0439\u0441\u0442\u0432\u0438\u0435 \u0438 \u0431\u0438\u0437\u043d\u0435\u0441 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u0432 \u0442\u0435\u043b\u0435\u043a\u043e\u043c\u043c\u0443\u043d\u0438\u043a\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u043c \u043f\u043e\u043b\u0435.\n\n\u042f\u043f\u043e\u043d\u0441\u043a\u0438\u0439 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a \u0440\u0435\u0448\u0435\u043d\u0438\u0439 \u043f\u043e \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Trend Micro \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u044b\u0435 \u0434\u0432\u0435 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0440\u044f\u0434 \u0435\u0435 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u043b\u0438\u043d\u0435\u0439\u043a\u0438 Hybrid Cloud Security.\n\n\u041e\u0448\u0438\u0431\u043a\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u0438\u0441\u0442\u0430\u043c\u0438 \u0448\u0432\u0435\u0439\u0446\u0430\u0440\u0441\u043a\u043e-\u043d\u0435\u043c\u0435\u0446\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u043f\u043e \u043a\u0438\u0431\u0435\u0440\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Modzero, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u0438 \u0438 PoC-\u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u044b \u0432 \u0442\u043e\u0442 \u0436\u0435 \u0434\u0435\u043d\u044c, \u043a\u043e\u0433\u0434\u0430 Trend Micro \u043e\u0431\u044a\u044f\u0432\u0438\u043b\u0430 \u043e\u0431 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u0445.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2022-23119 \u0438 CVE-2022-23120, \u0432\u043b\u0438\u044f\u044e\u0442 \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u044f Deep Security \u0438 Cloud One \u0434\u043b\u044f \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u043d\u0430\u0433\u0440\u0443\u0437\u043e\u043a, \u0432 \u0447\u0430\u0441\u0442\u043d\u043e\u0441\u0442\u0438 \u043d\u0430 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442 \u0430\u0433\u0435\u043d\u0442\u0430 Linux.\n\n\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Modzero \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0438, \u0447\u0442\u043e Deep Security Agent \u0434\u043b\u044f Linux \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0431\u0445\u043e\u0434\u0430 \u043a\u0430\u0442\u0430\u043b\u043e\u0433\u0430, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u0447\u0438\u0442\u0430\u0442\u044c \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u044b\u0435 \u0444\u0430\u0439\u043b\u044b, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u043e\u0448\u0438\u0431\u043a\u0443 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u043a\u043e\u0442\u043e\u0440\u0443\u044e \u043c\u043e\u0436\u043d\u043e \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u043c\u0430\u043d\u0434 \u043e\u0442 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f root. \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043b\u044f \u0440\u0435\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u043e\u0432\u0430\u0440\u043d\u043e\u0433\u043e \u0437\u0430\u043c\u044b\u0441\u043b\u0430 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u043c\u0435\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438 \u0443\u0441\u043b\u043e\u0432\u0438\u0438 \u0447\u0442\u043e \u0430\u0433\u0435\u043d\u0442 \u043d\u0435 \u0431\u044b\u043b \u0430\u043a\u0442\u0438\u0432\u0438\u0440\u043e\u0432\u0430\u043d \u0438\u043b\u0438 \u043d\u0430\u0441\u0442\u0440\u043e\u0435\u043d.\n\n\u0412 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0430\u0446\u0438\u044f\u0445 Modzero \u0442\u0430\u043a\u0436\u0435 \u0443\u043f\u043e\u043c\u0438\u043d\u0430\u0435\u0442\u0441\u044f, \u0447\u0442\u043e \u0441 Deep Security Agent \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0437\u0430\u043a\u043e\u0434\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0439 X.509 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0430\u0432\u0442\u043e\u0440\u0438\u0437\u0430\u0446\u0438\u0438 \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u0438 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0439 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u0439 \u043a\u043b\u044e\u0447. \u0421\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u0435\u0442\u0441\u044f \u0434\u043b\u044f \u0441\u0432\u044f\u0437\u0438 \u0441 \u0441\u0435\u0440\u0432\u0435\u0440\u043e\u043c \u0434\u043e \u0430\u043a\u0442\u0438\u0432\u0430\u0446\u0438\u0438 \u0430\u0433\u0435\u043d\u0442\u0430. \u041f\u043e\u0441\u043a\u043e\u043b\u044c\u043a\u0443 \u044d\u0442\u043e\u0442 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u043f\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0441 \u0437\u0430\u043a\u0440\u044b\u0442\u044b\u043c \u043a\u043b\u044e\u0447\u043e\u043c, \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0438 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u0442\u044c \u0441\u0432\u043e\u0439 \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u0439 \u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u0438\u043c\u0438\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0441\u0435\u0440\u0432\u0435\u0440 \u0438 \u043e\u0442\u043f\u0440\u0430\u0432\u043b\u044f\u0442\u044c \u043a\u043e\u043c\u0430\u043d\u0434\u044b \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u043e\u043c\u0443 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u043e\u043c\u0443 \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u044e.\n\n\u0420\u0430\u0437\u0443\u043c\u0435\u0435\u0442\u0441\u044f Trend Micro \u043f\u0440\u043e\u0438\u043d\u0444\u043e\u0440\u043c\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 \u043e\u0431 \u043e\u0448\u0438\u0431\u043a\u0430\u0445 \u0438 \u0442\u044f\u043d\u0443\u0442\u044c \u0441 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u043d\u0435 \u0441\u0442\u043e\u0438\u0442, \u0442\u0430\u043a \u043a\u0430\u043a \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 \u044f\u043f\u043e\u043d\u0441\u043a\u043e\u0439 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 \u0443\u0436\u0435 \u043d\u0435 \u0440\u0430\u0437 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438 \u0432 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u0430\u0445 Apex One.\n\n\u041f\u0430\u0440\u0430\u043b\u043b\u0435\u043b\u044c\u043d\u043e \u0440\u0430\u0431\u043e\u0442\u0443 \u043d\u0430\u0434 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0440\u043e\u0432\u0435\u043b\u0430 \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u0430\u044f \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f ESET, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u043b\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 CVE-2021-37852, \u0432\u043b\u0438\u044f\u044e\u0449\u0443\u044e \u043d\u0430 \u043a\u043b\u0438\u0435\u043d\u0442\u043e\u0432 Windows.\n\n\u041a\u0430\u043a \u0433\u043e\u0432\u043e\u0440\u0438\u0442\u0441\u044f \u0432 \u0431\u044e\u043b\u043b\u0435\u0442\u0435\u043d\u0435 \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043c\u043e\u0436\u0435\u0442 \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u044d\u0442\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c\u044e, \u0447\u0442\u043e\u0431\u044b \u043d\u0435\u043f\u0440\u0430\u0432\u043e\u043c\u0435\u0440\u043d\u043e \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0444\u0443\u043d\u043a\u0446\u0438\u044e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f AMSI \u0434\u043b\u044f \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u0432 \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u0441\u0446\u0435\u043d\u0430\u0440\u0438\u044f\u0445.\n\n\u041f\u0440\u043e\u0434\u0443\u043a\u0442\u044b, \u043f\u043e\u0434\u0432\u0435\u0440\u0436\u0435\u043d\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044e\u0442 \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u043e \u0432\u0435\u0440\u0441\u0438\u0439 ESET NOD32 Antivirus, Internet Security, Smart Security \u0438 Smart Security Premium, Endpoint Antivirus \u0438 Endpoint Security \u0434\u043b\u044f Windows, Server Security \u0438 File Security \u0434\u043b\u044f Windows Server, Server Security \u0434\u043b\u044f Azure, Security \u0434\u043b\u044f SharePoint Server \u0438 Mail Security \u0434\u043b\u044f IBM Domino \u0438 \u0434\u043b\u044f Exchange Server. ESET \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u0441\u0435\u0440\u0438\u044e \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0439 \u0434\u043b\u044f \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u044d\u0442\u043e\u0439 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0435\u0449\u0435 \u0432 \u0434\u0435\u043a\u0430\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430, \u0430 \u0432 \u044f\u043d\u0432\u0430\u0440\u0435 2022 \u0432\u044b\u0448\u043b\u0438 \u043f\u0430\u0442\u0447\u0438 \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u0441\u0442\u0430\u0440\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438.\n\n\u0421\u043f\u0438\u0441\u043e\u043a \u043a\u043e\u043d\u0435\u0447\u043d\u043e \u0432\u043d\u0443\u0448\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439, \u043d\u043e \u0432 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 ESET \u0437\u0430\u0432\u0435\u0440\u0438\u043b\u0438, \u0447\u0442\u043e \u0432 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0435 \u0441\u0443\u0449\u0435\u0441\u0442\u0432\u0443\u0435\u0442 \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0449\u0438\u0445 \u044d\u0442\u0443 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c. \u042d\u0442\u043e \u043a\u043e\u043d\u0447\u0435\u043d\u043e \u043d\u0435 \u043c\u043e\u0436\u0435\u0442 \u043d\u0435 \u0440\u0430\u0434\u043e\u0432\u0430\u0442\u044c, \u043d\u043e \u043f\u0440\u0435\u043d\u0435\u0431\u0440\u0435\u0433\u0430\u0442\u044c \u0441\u0432\u043e\u0435\u0432\u0440\u0435\u043c\u0435\u043d\u043d\u044b\u043c\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0432\u0441\u0435 \u0436\u0435 \u043d\u0435 \u043d\u0443\u0436\u043d\u043e.", "creation_timestamp": "2022-02-03T16:00:44.000000Z"}, {"uuid": "9f34a0ec-ea8b-44c5-ae3b-c3055883456d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37852", "type": "seen", "source": "https://t.me/information_security_channel/46518", "content": "ESET Patches High-Severity Vulnerability in Windows Applications\nhttps://www.securityweek.com/eset-patches-high-severity-vulnerability-windows-applications\n\nAntivirus firm ESET on Monday announced patches for a local privilege escalation vulnerability impacting its Windows clients.\nTracked as CVE-2021-37852 and reported to ESET by the Zero Day Initiative (ZDI), the vulnerability is considered \u201chigh severity,\u201d as it could allow an attacker to misuse the AMSI scanning feature.\nread more (https://www.securityweek.com/eset-patches-high-severity-vulnerability-windows-applications)", "creation_timestamp": "2022-02-02T13:32:10.000000Z"}, {"uuid": "5eaf7eb7-06eb-4928-9175-8b9ae761313d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37852", "type": "seen", "source": "https://t.me/hacking_Attack/41284", "content": "Black Hat Ethical Hacking\nESET antivirus bug let attackers gain Windows SYSTEM privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ESET antivirus bug let attackers gain Windows SYSTEM privilegesPost Views: 188 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe flaw (CVE-2021-37852) was reported by Michael DePlante of Trend Micro\u2019s Zero Day Initiative, and it enables attackers to escalate privileges to NT AUTHORITY\\SYSTEM account rights (the highest level of privileges on a Windows system) using the Windows Antimalware Scan Interface (AMSI).\nSlovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. AMSI\u00a0was first introduced with Windows 10 Technical Preview in 2015, and it allows apps and services to request memory buffer scans from any major antivirus product installed on the system. According to ESET, this can only be achieved after attackers gain SeImpersonatePrivilege rights, normally assigned to users in the local Administrators group and the device\u2019s local Service account to impersonate a client after authentication which should \u201climit the impact of this vulnerability.\u201d\n\nHowever, ZDI\u2019s advisory\u00a0says attackers are only required to \u201cobtain the ability to execute low-privileged code on the target system,\u201d which matches ESET\u2019s CVSS severity rating\u00a0also showing that\u00a0the bug can be exploited by threat actors with low privileges.\n\nWhile ESET said it only found out about this bug on November 18, a disclosure timeline available in ZDI\u2019s advisory reveals that the vulnerability was reported four months earlier, on June 18, 2021.\nSee Also: Complete Offensive Security and Ethical Hacking Course Affected ESET productsThe list of products impacted by this vulnerability is quite long, and it includes:\n\n* ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, and ESET Smart Security Premium from version 10.0.337.1 to 15.0.18.0\n* ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows from version 6.6.2046.0 to 9.0.2032.4\n* ESET Server Security for Microsoft Windows Server 8.0.12003.0 and 8.0.12003.1, ESET File Security for Microsoft Windows Server from version 7.0.12014.0 to 7.3.12006.0\n* ESET Server Security for Microsoft Azure from version 7.0.12016.1002 to 7.2.12004.1000\n* ESET Security for Microsoft SharePoint Server from version 7.0.15008.0 to 8.0.15004.0\n* ESET Mail Security for IBM Domino from version 7.0.14008.0 to 8.0.14004.0\n* ESET Mail Security for Microsoft Exchange Server from version 7.0.10019 to 8.0.10016.0\nSee Also: Windows vulnerability with new public exploits lets you become admin Users of ESET Server Security for Microsoft Azure are also advised\u00a0to immediately update ESET File Security for Microsoft Azure to the latest available version of ESET Server Security for Microsoft Windows Server to address the flaw.\n\nThe antivirus maker released multiple security updates between December 8 and January 31\u00a0to address this vulnerability, when it patched the last vulnerable product exposed to attacks.\n\nLuckily, ESET\u00a0found no evidence of exploits designed to target products affected by this security bug in the wild.\n\n\u201cThe attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u2019 Advanced setup,\u201d ESET added.\n\n\u201cHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible[...]", "creation_timestamp": "2026-09-01T20:01:57.352752Z"}, {"uuid": "bb198071-7133-4b66-a7c3-9492187e719c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37852", "type": "seen", "source": "https://t.me/hacking_Attack/41284", "content": "Black Hat Ethical Hacking\nESET antivirus bug let attackers gain Windows SYSTEM privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ESET antivirus bug let attackers gain Windows SYSTEM privilegesPost Views: 188 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe flaw (CVE-2021-37852) was reported by Michael DePlante of Trend Micro\u2019s Zero Day Initiative, and it enables attackers to escalate privileges to NT AUTHORITY\\SYSTEM account rights (the highest level of privileges on a Windows system) using the Windows Antimalware Scan Interface (AMSI).\nSlovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. AMSI\u00a0was first introduced with Windows 10 Technical Preview in 2015, and it allows apps and services to request memory buffer scans from any major antivirus product installed on the system. According to ESET, this can only be achieved after attackers gain SeImpersonatePrivilege rights, normally assigned to users in the local Administrators group and the device\u2019s local Service account to impersonate a client after authentication which should \u201climit the impact of this vulnerability.\u201d\n\nHowever, ZDI\u2019s advisory\u00a0says attackers are only required to \u201cobtain the ability to execute low-privileged code on the target system,\u201d which matches ESET\u2019s CVSS severity rating\u00a0also showing that\u00a0the bug can be exploited by threat actors with low privileges.\n\nWhile ESET said it only found out about this bug on November 18, a disclosure timeline available in ZDI\u2019s advisory reveals that the vulnerability was reported four months earlier, on June 18, 2021.\nSee Also: Complete Offensive Security and Ethical Hacking Course Affected ESET productsThe list of products impacted by this vulnerability is quite long, and it includes:\n\n* ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, and ESET Smart Security Premium from version 10.0.337.1 to 15.0.18.0\n* ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows from version 6.6.2046.0 to 9.0.2032.4\n* ESET Server Security for Microsoft Windows Server 8.0.12003.0 and 8.0.12003.1, ESET File Security for Microsoft Windows Server from version 7.0.12014.0 to 7.3.12006.0\n* ESET Server Security for Microsoft Azure from version 7.0.12016.1002 to 7.2.12004.1000\n* ESET Security for Microsoft SharePoint Server from version 7.0.15008.0 to 8.0.15004.0\n* ESET Mail Security for IBM Domino from version 7.0.14008.0 to 8.0.14004.0\n* ESET Mail Security for Microsoft Exchange Server from version 7.0.10019 to 8.0.10016.0\nSee Also: Windows vulnerability with new public exploits lets you become admin Users of ESET Server Security for Microsoft Azure are also advised\u00a0to immediately update ESET File Security for Microsoft Azure to the latest available version of ESET Server Security for Microsoft Windows Server to address the flaw.\n\nThe antivirus maker released multiple security updates between December 8 and January 31\u00a0to address this vulnerability, when it patched the last vulnerable product exposed to attacks.\n\nLuckily, ESET\u00a0found no evidence of exploits designed to target products affected by this security bug in the wild.\n\n\u201cThe attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u2019 Advanced setup,\u201d ESET added.\n\n\u201cHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible[...]", "creation_timestamp": "2026-09-02T01:02:18.934753Z"}, {"uuid": "62b6051c-6e59-4345-b4e4-9d0358d8748f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37852", "type": "seen", "source": "https://t.me/hacking_Attack/41284", "content": "Black Hat Ethical Hacking\nESET antivirus bug let attackers gain Windows SYSTEM privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ESET antivirus bug let attackers gain Windows SYSTEM privilegesPost Views: 188 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe flaw (CVE-2021-37852) was reported by Michael DePlante of Trend Micro\u2019s Zero Day Initiative, and it enables attackers to escalate privileges to NT AUTHORITY\\SYSTEM account rights (the highest level of privileges on a Windows system) using the Windows Antimalware Scan Interface (AMSI).\nSlovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. AMSI\u00a0was first introduced with Windows 10 Technical Preview in 2015, and it allows apps and services to request memory buffer scans from any major antivirus product installed on the system. According to ESET, this can only be achieved after attackers gain SeImpersonatePrivilege rights, normally assigned to users in the local Administrators group and the device\u2019s local Service account to impersonate a client after authentication which should \u201climit the impact of this vulnerability.\u201d\n\nHowever, ZDI\u2019s advisory\u00a0says attackers are only required to \u201cobtain the ability to execute low-privileged code on the target system,\u201d which matches ESET\u2019s CVSS severity rating\u00a0also showing that\u00a0the bug can be exploited by threat actors with low privileges.\n\nWhile ESET said it only found out about this bug on November 18, a disclosure timeline available in ZDI\u2019s advisory reveals that the vulnerability was reported four months earlier, on June 18, 2021.\nSee Also: Complete Offensive Security and Ethical Hacking Course Affected ESET productsThe list of products impacted by this vulnerability is quite long, and it includes:\n\n* ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, and ESET Smart Security Premium from version 10.0.337.1 to 15.0.18.0\n* ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows from version 6.6.2046.0 to 9.0.2032.4\n* ESET Server Security for Microsoft Windows Server 8.0.12003.0 and 8.0.12003.1, ESET File Security for Microsoft Windows Server from version 7.0.12014.0 to 7.3.12006.0\n* ESET Server Security for Microsoft Azure from version 7.0.12016.1002 to 7.2.12004.1000\n* ESET Security for Microsoft SharePoint Server from version 7.0.15008.0 to 8.0.15004.0\n* ESET Mail Security for IBM Domino from version 7.0.14008.0 to 8.0.14004.0\n* ESET Mail Security for Microsoft Exchange Server from version 7.0.10019 to 8.0.10016.0\nSee Also: Windows vulnerability with new public exploits lets you become admin Users of ESET Server Security for Microsoft Azure are also advised\u00a0to immediately update ESET File Security for Microsoft Azure to the latest available version of ESET Server Security for Microsoft Windows Server to address the flaw.\n\nThe antivirus maker released multiple security updates between December 8 and January 31\u00a0to address this vulnerability, when it patched the last vulnerable product exposed to attacks.\n\nLuckily, ESET\u00a0found no evidence of exploits designed to target products affected by this security bug in the wild.\n\n\u201cThe attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u2019 Advanced setup,\u201d ESET added.\n\n\u201cHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible[...]", "creation_timestamp": "2026-09-06T11:00:06.121091Z"}, {"uuid": "c3c08d83-17a5-48c9-b584-8b8eee4dc338", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-37852", "type": "seen", "source": "https://t.me/hacking_Attack/41284", "content": "Black Hat Ethical Hacking\nESET antivirus bug let attackers gain Windows SYSTEM privileges\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png ESET antivirus bug let attackers gain Windows SYSTEM privilegesPost Views: 188 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute\nThe flaw (CVE-2021-37852) was reported by Michael DePlante of Trend Micro\u2019s Zero Day Initiative, and it enables attackers to escalate privileges to NT AUTHORITY\\SYSTEM account rights (the highest level of privileges on a Windows system) using the Windows Antimalware Scan Interface (AMSI).\nSlovak internet security firm ESET released security fixes to address a high severity local privilege escalation vulnerability affecting multiple products on systems running Windows 10 and later or Windows Server 2016 and above. AMSI\u00a0was first introduced with Windows 10 Technical Preview in 2015, and it allows apps and services to request memory buffer scans from any major antivirus product installed on the system. According to ESET, this can only be achieved after attackers gain SeImpersonatePrivilege rights, normally assigned to users in the local Administrators group and the device\u2019s local Service account to impersonate a client after authentication which should \u201climit the impact of this vulnerability.\u201d\n\nHowever, ZDI\u2019s advisory\u00a0says attackers are only required to \u201cobtain the ability to execute low-privileged code on the target system,\u201d which matches ESET\u2019s CVSS severity rating\u00a0also showing that\u00a0the bug can be exploited by threat actors with low privileges.\n\nWhile ESET said it only found out about this bug on November 18, a disclosure timeline available in ZDI\u2019s advisory reveals that the vulnerability was reported four months earlier, on June 18, 2021.\nSee Also: Complete Offensive Security and Ethical Hacking Course Affected ESET productsThe list of products impacted by this vulnerability is quite long, and it includes:\n\n* ESET NOD32 Antivirus, ESET Internet Security, ESET Smart Security, and ESET Smart Security Premium from version 10.0.337.1 to 15.0.18.0\n* ESET Endpoint Antivirus for Windows and ESET Endpoint Security for Windows from version 6.6.2046.0 to 9.0.2032.4\n* ESET Server Security for Microsoft Windows Server 8.0.12003.0 and 8.0.12003.1, ESET File Security for Microsoft Windows Server from version 7.0.12014.0 to 7.3.12006.0\n* ESET Server Security for Microsoft Azure from version 7.0.12016.1002 to 7.2.12004.1000\n* ESET Security for Microsoft SharePoint Server from version 7.0.15008.0 to 8.0.15004.0\n* ESET Mail Security for IBM Domino from version 7.0.14008.0 to 8.0.14004.0\n* ESET Mail Security for Microsoft Exchange Server from version 7.0.10019 to 8.0.10016.0\nSee Also: Windows vulnerability with new public exploits lets you become admin Users of ESET Server Security for Microsoft Azure are also advised\u00a0to immediately update ESET File Security for Microsoft Azure to the latest available version of ESET Server Security for Microsoft Windows Server to address the flaw.\n\nThe antivirus maker released multiple security updates between December 8 and January 31\u00a0to address this vulnerability, when it patched the last vulnerable product exposed to attacks.\n\nLuckily, ESET\u00a0found no evidence of exploits designed to target products affected by this security bug in the wild.\n\n\u201cThe attack surface can also be eliminated by disabling the Enable advanced scanning via AMSI option in ESET products\u2019 Advanced setup,\u201d ESET added.\n\n\u201cHowever, ESET strongly recommends performing an upgrade to a fixed product version and only applying this workaround when the upgrade is not possible[...]", "creation_timestamp": "2026-09-07T01:00:17.654121Z"}]}