{"vulnerability": "CVE-2021-40981", "sightings": [{"uuid": "e04643ff-0a35-44e6-baaf-764f18966e31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7346", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Stealing weapons from the Armoury\n\nRoot cause analysis of a privilege escalation vulnerability in ASUS ROG Armoury Crate Lite Service v4.2.8 (CVE-2021-40981)\n\nhttps://aptw.tf/2021/09/24/armoury-crate-privesc.html", "creation_timestamp": "2021-09-28T18:40:51.000000Z"}, {"uuid": "507ee2de-a022-4fa7-ae52-40bedba5541a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "seen", "source": "https://t.me/cibsecurity/29436", "content": "\u203c CVE-2021-40981 \u203c\n\nASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\\ASUS\\GamingCenterLib directory.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-09-27T12:34:37.000000Z"}, {"uuid": "09cfc94e-cf60-47a8-a7c5-9c83ce1f069e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4396", "content": "#Analytics\nStealing weapons from the Armoury\nhttps://aptw.tf/2021/09/24/armoury-crate-privesc.html\n// Root cause analysis of a privilege escalation vulnerability in ASUS ROG Armoury Crate Lite Service v4.2.8 (CVE-2021-40981)", "creation_timestamp": "2021-09-28T12:00:40.000000Z"}, {"uuid": "0a589984-174d-4236-a65c-d3bcfd110139", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1659", "content": "Stealing weapons from the Armoury (CVE-2021-40981 analysis) https://aptw.tf/2021/09/24/armoury-crate-privesc.html", "creation_timestamp": "2026-08-03T06:06:33.628330Z"}, {"uuid": "c258cf55-d806-41e5-9b04-c30ede6c8634", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1659", "content": "Stealing weapons from the Armoury (CVE-2021-40981 analysis) https://aptw.tf/2021/09/24/armoury-crate-privesc.html", "creation_timestamp": "2026-08-04T00:00:48.070456Z"}, {"uuid": "e205bbf6-bc77-4a6b-ad9d-f683ef9fdc56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "seen", "source": "https://t.me/reverseame/1659", "content": "Stealing weapons from the Armoury (CVE-2021-40981 analysis) https://aptw.tf/2021/09/24/armoury-crate-privesc.html", "creation_timestamp": "2026-07-29T12:02:53.218952Z"}, {"uuid": "5d5fa5dc-321a-4fe1-b14e-b10ea95d7022", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "seen", "source": "https://t.me/reverseame/1659", "content": "Stealing weapons from the Armoury (CVE-2021-40981 analysis) https://aptw.tf/2021/09/24/armoury-crate-privesc.html", "creation_timestamp": "2026-07-30T00:02:43.571674Z"}, {"uuid": "6b249ba6-7b18-4281-820b-2571b057f74a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "seen", "source": "https://t.me/cissp/4487", "content": "exploit\n1. RCE in Visual Studio Code Remote Development Extension\nhttps://www.shielder.it/advisories/remote-command-execution-in-visual-studio-code-remote-development-extension\n2. iOS 15 0-day exploits:\nhttps://github.com/illusionofchaos/ios-gamed-0day\nhttps://github.com/illusionofchaos/ios-nehelper-wifi-info-0day\nhttps://github.com/illusionofchaos/ios-nehelper-enum-apps-0day\n\nSADDNS:\nSide Channel Based DNS Cache Poisoning Attack\nhttps://github.com/seclab-ucr/SADDNS\n\nAnalytics\nStealing weapons from the Armoury\nhttps://aptw.tf/2021/09/24/armoury-crate-privesc.html\n// Root cause analysis of a privilege escalation vulnerability in ASUS ROG Armoury Crate Lite Service v4.2.8 (CVE-2021-40981)\n\nMalware analysis\n1. FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor\nhttps://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor\n2. ERMAC Android Malware\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\n\nThreat Research\n1. Case Analysis DiscuzX 3.4 SSRF Vulnerability\nhttps://blog.topsec.com.cn/discuzx-3-4-ssrf\n2. BloodyStealer and gaming assets for sale\nhttps://securelist.com/bloodystealer-and-gaming-assets-for-sale/104319\n3. Trend Micro ServerProtect Authentication Bypass Vulnerability\nhttps://www.zerodayinitiative.com/advisories/ZDI-21-1115\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-01T17:00:39.321155Z"}, {"uuid": "21d28132-49f2-4bed-a552-c67c469bdf04", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-40981", "type": "seen", "source": "https://t.me/cissp/4487", "content": "exploit\n1. RCE in Visual Studio Code Remote Development Extension\nhttps://www.shielder.it/advisories/remote-command-execution-in-visual-studio-code-remote-development-extension\n2. iOS 15 0-day exploits:\nhttps://github.com/illusionofchaos/ios-gamed-0day\nhttps://github.com/illusionofchaos/ios-nehelper-wifi-info-0day\nhttps://github.com/illusionofchaos/ios-nehelper-enum-apps-0day\n\nSADDNS:\nSide Channel Based DNS Cache Poisoning Attack\nhttps://github.com/seclab-ucr/SADDNS\n\nAnalytics\nStealing weapons from the Armoury\nhttps://aptw.tf/2021/09/24/armoury-crate-privesc.html\n// Root cause analysis of a privilege escalation vulnerability in ASUS ROG Armoury Crate Lite Service v4.2.8 (CVE-2021-40981)\n\nMalware analysis\n1. FoggyWeb: Targeted NOBELIUM malware leads to persistent backdoor\nhttps://www.microsoft.com/security/blog/2021/09/27/foggyweb-targeted-nobelium-malware-leads-to-persistent-backdoor\n2. ERMAC Android Malware\nhttps://www.threatfabric.com/blogs/ermac-another-cerberus-reborn.html\n\nThreat Research\n1. Case Analysis DiscuzX 3.4 SSRF Vulnerability\nhttps://blog.topsec.com.cn/discuzx-3-4-ssrf\n2. BloodyStealer and gaming assets for sale\nhttps://securelist.com/bloodystealer-and-gaming-assets-for-sale/104319\n3. Trend Micro ServerProtect Authentication Bypass Vulnerability\nhttps://www.zerodayinitiative.com/advisories/ZDI-21-1115\n\n\n\u200e\u200b", "creation_timestamp": "2026-09-02T01:04:24.615389Z"}]}