{"vulnerability": "cve-2021-3438", "sightings": [{"uuid": "bcf15429-5ad0-4fe2-981d-a47123394e75", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "MISP/f4a8ef75-74cc-4b6b-a608-3450462e7100", "content": "", "creation_timestamp": "2024-11-14T06:09:20.000000Z"}, {"uuid": "39951c50-485f-4f27-92ab-e28ec86c4ee5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/154", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aDetection and remediation for CVE-2021-3438 with Powershell\nURL\uff1ahttps://github.com/TobiasS1402/CVE-2021-3438", "creation_timestamp": "2021-07-28T14:53:25.000000Z"}, {"uuid": "6d58f6fb-a994-470f-a16c-dc1251f03748", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/167", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-3438\nURL\uff1ahttps://github.com/wuyoukm/CVE-2021-3438", "creation_timestamp": "2021-07-29T03:53:36.000000Z"}, {"uuid": "8a77f5d0-5f4a-42aa-9d83-9c538aa27d9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/128", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProof of concept code for CVE-2021-3438\nURL\uff1ahttps://github.com/Crystalware/CVE-2021-3438", "creation_timestamp": "2021-07-27T06:07:07.000000Z"}, {"uuid": "b1a9cba4-049f-4065-96ad-d35086cdb0aa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/sanspie_notes/19", "content": "An article about cve-2021-3438, a vurnabilety in many printers\n\nhttps://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/", "creation_timestamp": "2021-07-23T18:41:24.000000Z"}, {"uuid": "fa890f27-42e5-4030-9efd-243cd5f3ed21", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/ctinow/37248", "content": "A 16-year-old bug (CVE-2021-3438) in printer driver affects millions of printers worldwide\n\nhttps://ift.tt/2UwpMCb", "creation_timestamp": "2021-07-20T20:46:14.000000Z"}, {"uuid": "811fa5b2-b6d2-4c6f-99ad-6ec59ace7e68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityIL/4407", "content": "\u05d1\u05d0\u05d2 \u05d1\u05df 16 \u05e9\u05e0\u05d4 \u05d1\u05de\u05d3\u05e4\u05e1\u05d5\u05ea HP, Xerox \u05d5-\u05e1\u05de\u05e1\u05d5\u05e0\u05d2 \u05de\u05d0\u05e4\u05e9\u05e8 \u05dc\u05d4\u05d0\u05e7\u05e8\u05d9\u05dd \u05dc\u05d4\u05e9\u05d9\u05d2 \u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05e0\u05d9\u05d4\u05d5\u05dc.\n\n\u05d7\u05d1\u05e8\u05ea \u05d4\u05e1\u05d9\u05d9\u05d1\u05e8 SentinelOne \u05de\u05e4\u05e8\u05e1\u05de\u05ea \u05d3\u05d5\"\u05d7 \u05d1\u05d5 \u05d4\u05d9\u05d0 \u05de\u05d3\u05d5\u05d5\u05d7\u05ea \u05e2\u05dc \u05d1\u05d0\u05d2 \u05d1\u05d3\u05e8\u05d9\u05d9\u05d1\u05e8 \u05d4\u05e7\u05d9\u05d9\u05dd \u05d1\u05de\u05d3\u05e4\u05e1\u05d5\u05ea \u05e9\u05dc \u05de\u05e1\u05e4\u05e8 \u05d7\u05d1\u05e8\u05d5\u05ea \u05d5\u05de\u05d0\u05e4\u05e9\u05e8 \u05dc\u05d4\u05d0\u05e7\u05e8\u05d9\u05dd \u05dc\u05d4\u05e9\u05d9\u05d2 \u05d4\u05e8\u05e9\u05d0\u05d5\u05ea \u05e0\u05d9\u05d4\u05d5\u05dc \u05e2\u05dc \u05d4\u05ea\u05d7\u05e0\u05d5\u05ea \u05d1\u05d0\u05e8\u05d2\u05d5\u05df.\n\n\u05d4\u05e4\u05d2\u05d9\u05e2\u05d5\u05ea CVE-2021-3438 \u05db\u05d1\u05e8 \u05e4\u05d5\u05e8\u05e1\u05de\u05d4 \u05d5\u05e2\u05d3\u05db\u05d5\u05df \u05e2\"\u05d9 \u05d7\u05d1\u05e8\u05d5\u05ea HP \u05d5-Xerox \u05db\u05d1\u05e8 \u05d6\u05de\u05d9\u05df \u05dc\u05d4\u05ea\u05e7\u05e0\u05d4.\n\nhttps://t.me/CyberSecurityIL/1183\n\nhttps://www.bleepingcomputer.com/news/security/16-year-old-bug-in-printer-software-gives-hackers-admin-rights/", "creation_timestamp": "2021-07-20T16:30:10.000000Z"}, {"uuid": "0d66a0c2-2334-4348-abfd-96bc6c90eace", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/true_secator/1928", "content": "\u041e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2005 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 16 \u043b\u0435\u0442 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 HP, Xerox \u0438 Samsung \u0438\u043c\u0435\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u043e\u0442\u043d\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443 \u0438 \u0434\u0430\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0414\u043e\u0438\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0431\u0430\u0433 \u043e\u0442\u043a\u0440\u044b\u043b\u0438 SentinelOne, \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u0432 \u0435\u043c\u0443 CVE-2021-3438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043b\u0430\u0432\u044f\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0440\u0430\u043d\u0435\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 12-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 Microsoft Defender, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0432\u0430\u043b\u0430 \u0440\u0443\u0442\u0430 \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows.\n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 SSPORT.SYS \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0421\u0430\u043c\u043e\u0435 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e\u0435, \u0447\u0442\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f Windows \u043f\u043e\u0441\u043b\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041e\u0448\u0438\u0431\u043a\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0442\u044c, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u0440\u0438\u043d\u0442\u0435\u0440 \u043d\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443. \u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0431\u0430\u0433\u0443.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u044b  \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2021-3438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.", "creation_timestamp": "2021-07-20T14:09:42.000000Z"}, {"uuid": "d8ee0e3e-73d6-49e1-8375-912b55f78e10", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34385", "type": "seen", "source": "https://t.me/cibsecurity/25814", "content": "\u203c CVE-2021-34385 \u203c\n\nTrusty TLK contains a vulnerability in the NVIDIA TLK kernel where an integer overflow in the calculation of a length could lead to a heap overflow.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-06-30T14:29:57.000000Z"}, {"uuid": "30252e20-4dd4-4ae9-ba7b-1f3519443f0b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-34383", "type": "seen", "source": "https://t.me/cibsecurity/25812", "content": "\u203c CVE-2021-34383 \u203c\n\nBootloader contains a vulnerability in NVIDIA MB2 where a potential heap overflow might lead to denial of service or escalation of privileges.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-06-30T14:29:55.000000Z"}, {"uuid": "3d1f51f5-3959-4b59-a079-8f466375ae7e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/reverse_dungeon/2950", "content": "https://voidsec.com/root-cause-analysis-of-cve-2021-3438", "creation_timestamp": "2023-03-23T07:59:09.000000Z"}, {"uuid": "1d36b85e-0d15-4562-b56a-f8ffe2168f7a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "Telegram/zfzu64-g8Otebz-coFDbLijn4Q0zrmo-DB0chlPULqQg6-Q", "content": "", "creation_timestamp": "2021-05-20T20:37:11.000000Z"}, {"uuid": "9ffdc9d8-84f5-4f2c-93c7-7e38836fde8b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "exploited", "source": "https://t.me/thehackernews/1384", "content": "Millions of HP, Samsung and Xerox printers worldwide are vulnerable to a new vulnerability (CVE-2021-3438) that has gone undetected for 16 years.\n\nRead details: https://thehackernews.com/2021/07/16-year-old-security-bug-affects.html", "creation_timestamp": "2021-07-20T13:40:16.000000Z"}, {"uuid": "07c269cb-ac5d-46a2-a953-c6ea6220d120", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/SecLabNews/10565", "content": "\u041e\u043a\u0430\u0437\u044b\u0432\u0430\u0435\u0442\u0441\u044f \u043d\u0430\u0447\u0438\u043d\u0430\u044f \u0441 2005 \u0433\u043e\u0434\u0430 \u043d\u0430 \u043f\u0440\u043e\u0442\u044f\u0436\u0435\u043d\u0438\u0438 16 \u043b\u0435\u0442 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432 HP, Xerox \u0438 Samsung \u0438\u043c\u0435\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u043e\u0442\u043d\u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u043e\u0432 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u0438 \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u044b \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0432\u0441\u0435\u043c\u0443 \u043c\u0438\u0440\u0443 \u0438 \u0434\u0430\u0435\u0442 \u0445\u0430\u043a\u0435\u0440\u0430\u043c \u043f\u0440\u0430\u0432\u0430 \u0430\u0434\u043c\u0438\u043d\u0438\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430.\n\n\u0414\u043e\u0438\u0441\u0442\u043e\u0440\u0438\u0447\u0435\u0441\u043a\u0438\u0439 \u0431\u0430\u0433 \u043e\u0442\u043a\u0440\u044b\u043b\u0438 SentinelOne, \u043f\u0440\u0438\u0441\u0432\u043e\u0438\u0432 \u0435\u043c\u0443 CVE-2021-3438. \u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0441\u043b\u0430\u0432\u044f\u0442\u0441\u044f \u0442\u0435\u043c, \u0447\u0442\u043e \u0440\u0430\u043d\u0435\u0435 \u0443\u0436\u0435 \u043d\u0430\u0445\u043e\u0434\u0438\u043b\u0438 \u043e\u0448\u0438\u0431\u043a\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 12-\u043b\u0435\u0442\u043d\u0435\u0439 \u0434\u0430\u0432\u043d\u043e\u0441\u0442\u0438 \u0432 Microsoft Defender, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u0434\u0430\u0432\u0430\u043b\u0430 \u0440\u0443\u0442\u0430 \u0432 \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0445 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 Windows.\n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u0438\u043c \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0432\u044b\u044f\u0441\u043d\u0438\u0442\u044c, \u0447\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u043a\u0440\u043e\u0435\u0442\u0441\u044f \u0432 \u043f\u0435\u0440\u0435\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0438 \u0431\u0443\u0444\u0435\u0440\u0430 \u0432 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0435 SSPORT.SYS \u0434\u043b\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u0435\u043d\u043d\u044b\u0445 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u0432\u0435\u0441\u0442\u0438 \u043a \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044e \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f. \u0421\u0430\u043c\u043e\u0435 \u043f\u0435\u0447\u0430\u043b\u044c\u043d\u043e\u0435, \u0447\u0442\u043e \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u0441 \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0447\u0435\u0441\u043a\u0438 \u0443\u0441\u0442\u0430\u043d\u0430\u0432\u043b\u0438\u0432\u0430\u0435\u0442\u0441\u044f \u0432\u043c\u0435\u0441\u0442\u0435 \u0441 \u043f\u0440\u043e\u0433\u0440\u0430\u043c\u043c\u043d\u044b\u043c \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0435\u043d\u0438\u0435\u043c \u043f\u0440\u0438\u043d\u0442\u0435\u0440\u0430 \u0438 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442\u0441\u044f Windows \u043f\u043e\u0441\u043b\u0435 \u043a\u0430\u0436\u0434\u043e\u0439 \u043f\u0435\u0440\u0435\u0437\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0441\u0438\u0441\u0442\u0435\u043c\u044b. \u041e\u0448\u0438\u0431\u043a\u043e\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u043b\u043e\u0443\u043f\u043e\u0442\u0440\u0435\u0431\u043b\u044f\u0442\u044c, \u0434\u0430\u0436\u0435 \u0435\u0441\u043b\u0438 \u043f\u0440\u0438\u043d\u0442\u0435\u0440 \u043d\u0435 \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d \u043a \u0446\u0435\u043b\u0435\u0432\u043e\u043c\u0443 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0443. \u0414\u043b\u044f \u0443\u0441\u043f\u0435\u0448\u043d\u043e\u0439 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 \u0442\u0440\u0435\u0431\u0443\u0435\u0442\u0441\u044f \u0434\u043e\u0441\u0442\u0443\u043f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f, \u0430 \u044d\u0442\u043e \u043e\u0437\u043d\u0430\u0447\u0430\u0435\u0442, \u0447\u0442\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0441\u043d\u0430\u0447\u0430\u043b\u0430 \u0437\u0430\u043a\u0440\u0435\u043f\u0438\u0442\u044c\u0441\u044f \u043d\u0430 \u0446\u0435\u043b\u0435\u0432\u044b\u0445 \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432\u0430\u0445, \u043f\u043e\u0441\u043b\u0435 \u044d\u0442\u043e\u0433\u043e \u043e\u043d\u0438 \u043c\u043e\u0433\u0443\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c \u0431\u0430\u0433\u0443.\n\n\u041d\u0435\u0441\u043c\u043e\u0442\u0440\u044f \u043d\u0430 \u0442\u043e, \u0447\u0442\u043e \u043f\u0440\u0438\u043c\u0435\u0440\u044b  \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u0438 CVE-2021-3438 \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435 \u043d\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b, \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u0438 \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u044e\u0442 \u043a\u0430\u043a \u043c\u043e\u0436\u043d\u043e \u0441\u043a\u043e\u0440\u0435\u0435 \u043f\u0440\u0438\u043c\u0435\u043d\u0438\u0442\u044c \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f.", "creation_timestamp": "2021-07-20T14:10:19.000000Z"}, {"uuid": "eaff3bab-beaa-437f-bae6-55706be1b2f4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/3882", "content": "#Threat_Research\n1. CVE-2021-3438:\n16 Years In Hiding - Millions of Printers HP, Samsung, Xerox Worldwide Vulnerable\nhttps://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable\n2. Vulnerability in Apple\u2019s kernel (darwin-xnu)\nhttps://pwning.systems/posts/apple-kernel-vulnerability", "creation_timestamp": "2021-07-21T12:03:34.000000Z"}, {"uuid": "1fc286cb-919a-4fef-895c-352040578bd5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3969", "content": "Root Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438", "creation_timestamp": "2021-08-01T15:33:12.000000Z"}, {"uuid": "a4ac145c-a8cd-4c0f-a54d-323ece52d2ac", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/4016", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (July 1-31)\nCVE-2021-1675 - Windows Print Spooler EoP\nhttps://t.me/cybersecuritytechnologies/3723\nCVE-2021-34527 - Windows Print Spooler RCE\nhttps://t.me/cybersecuritytechnologies/3750\nCVE-2021-36934 - Windows SeriousSAM EoP\nhttps://t.me/cybersecuritytechnologies/3891\nCVE-2021-33909 - Sequoia - A LPE Vulnerability in Linux\u2019s Filesystem Layer\nhttps://t.me/cybersecuritytechnologies/3884\nCVE-2021-22555 - Heap out-of-bounds write vuln in Linux Netfilter\nhttps://t.me/cybersecuritytechnologies/3841\nCVE-2021-30807 - OOBR in AppleCLCD/IOMobileFrameBuffer\nhttps://t.me/cybersecuritytechnologies/3930\nCVE-2020-27020 - Vulnerability in Kaspersky Password Manager\nhttps://donjon.ledger.com/kaspersky-password-manager\nCVE-2021-35211 - SolarWinds Serv-U Managed File Transfer Vuln\nhttps://t.me/CyberSecurityTechnologies/4714\nCVE-2021-34481 - Windows Print Spooler EoP\nhttps://mobile.twitter.com/gentilkiwi/status/1416429860566847490\nCVE-2021-3438 - Printer\u2019s Drivers Vulnerability\nhttps://t.me/cybersecuritytechnologies/3969", "creation_timestamp": "2024-01-18T03:22:33.000000Z"}, {"uuid": "2dced4b4-01fa-45eb-8a22-25e1d349b388", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1440", "content": "Root Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438 https://voidsec.com/root-cause-analysis-of-cve-2021-3438/", "creation_timestamp": "2026-08-03T08:00:04.802770Z"}, {"uuid": "2d4c4775-5507-4e3e-854f-ef808e61c434", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1420", "content": "CVE-2021-3438: 16 Years In Hiding \u2013 Millions of Printers Worldwide Vulnerable https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/", "creation_timestamp": "2026-08-03T08:00:04.493244Z"}, {"uuid": "f4e22c20-3377-41d7-b151-98ca1c286619", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1420", "content": "CVE-2021-3438: 16 Years In Hiding \u2013 Millions of Printers Worldwide Vulnerable https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/", "creation_timestamp": "2026-08-04T00:00:46.085607Z"}, {"uuid": "39721381-c2ae-476b-b756-7cd562387885", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "published-proof-of-concept", "source": "https://t.me/reverseame/1440", "content": "Root Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438 https://voidsec.com/root-cause-analysis-of-cve-2021-3438/", "creation_timestamp": "2026-08-04T00:00:46.284446Z"}, {"uuid": "be2b9d56-d361-4aea-9738-4fc02c51a8b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://bsky.app/profile/ctsd-gmbh.bsky.social/post/3mtj5o44ttu2v", "content": "Claude Code hat in 30 Prompts einen funktionierenden macOS-Treiber fuer den HP Laser 1008a geschrieben. Der Treiber ist jetzt auf GitHub verfuegbar. Die Sicherheitsluecke CVE-2021-3438 ermoeglichte den\u2026\n\nhttps://www.ctsd.de/insights/2026-08-technik-ki-schreibt-druckertreiber-was-steckt-dahinter.html", "creation_timestamp": "2026-08-20T11:34:46.862293Z"}, {"uuid": "840f7ffa-be26-4227-92d7-2405455750c8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/reverseame/1440", "content": "Root Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438 https://voidsec.com/root-cause-analysis-of-cve-2021-3438/", "creation_timestamp": "2026-07-29T12:02:54.941259Z"}, {"uuid": "5cfe1f18-1f0e-4210-9d84-92d685293025", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/reverseame/1420", "content": "CVE-2021-3438: 16 Years In Hiding \u2013 Millions of Printers Worldwide Vulnerable https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/", "creation_timestamp": "2026-07-29T12:02:55.278237Z"}, {"uuid": "c9853c76-906a-4a6c-ab07-c0d9f0598b5b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/reverseame/1440", "content": "Root Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438 https://voidsec.com/root-cause-analysis-of-cve-2021-3438/", "creation_timestamp": "2026-07-30T00:02:45.251149Z"}, {"uuid": "bd42da55-8c4b-4eb3-84bd-43aa31101343", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/reverseame/1420", "content": "CVE-2021-3438: 16 Years In Hiding \u2013 Millions of Printers Worldwide Vulnerable https://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable/", "creation_timestamp": "2026-07-30T00:02:45.415338Z"}, {"uuid": "e1581d7e-3d7a-4347-80a4-74d0b4f23572", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3933", "content": "Blue Team Techniques\n1. Ghidra script to decrypt a string array in XOR DDoS\nhttps://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos\n2. One-stop TLS traffic inspection and manipulation using dynamic instrumentation\nhttps://blog.syss.com/posts/hallucinate\n\nOffensive security\n1. SSRF in Dependabot\nhttps://blog.tyage.net/posts/2021-06-27-dependabot-rce\n\nMalware analysis\nReverse engineer the malware Cryptowall to replicate the PE injection technique\nhttps://malwareunicorn.org/workshops/peinjection.html#0\n]-> https://github.com/malware-unicorn/GoPEInjection\n\nRed Team Tactics\n1. HTTP Server serving obfuscated Powershell Scripts/Payloads\nhttps://github.com/WazeHell/LightMe\n2. Native payload generation and shellcode injection tool that provides support for common platforms and architectures\nhttps://github.com/EntySec/HatVenom\n\nRoot Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438\n\nexploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2026-09-01T17:00:44.162952Z"}, {"uuid": "5fb80e8a-c034-48e7-9f5a-2f47940b9fa7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3917", "content": "Always check to ensure that you are downloading software from the legitimate website for the desired product.\nMITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Software Discovery - T1518 | [MITRE ATT&CK] Remote Services - T1021 | [MITRE ATT&CK] Command-Line Interface - T1059 | [MITRE ATT&CK] Standard Application Layer Protocol - T1071\nTags: Malware loader, MosaicLoader, Cracked software\nCVE-2021-3438: 16 Years in Hiding \u2013 Millions of Printers Worldwide Vulnerable\n(published: July 20, 2021)\nA high-severity vulnerability, registered as CVE-2021-3438, has been identified by SentinelLabs researchers that affects HP, Samsung, and Xerox printers. The vulnerability has resided in the printers\u2019 driver software since 2005. The number of printers created by HP, Samsung, and Xerox during the last 16 years amounts to over 380 different models by HP and Samsung and at least 12 Xerox models. Exploitation of CVE-2021-3438, which is a kernel driver vulnerability, can result in an unprivileged user account changing to \u201cSYSTEM account and run code in kernel mode (since the vulnerable driver is locally available to anyone).\u201d Researchers note that they have not seen this vulnerability actively-exploited in the wild.\nAnalyst Comment: The potential scope of this vulnerability is significant. Users should follow Security Advisories from both HP (HPSBPI03724) and Xerox (XRX21K) and apply the necessary patches as soon as possible. The list of affected HP and Samsung printer models can be found here, and the list of affected Xerox printers models can be found here.\nTags: Vulnerability, CVE-2021-3438, Printer driver software, HP, Samsung, Xerox\nRemcos RAT Delivered via Visual Basic\n(published: July 19, 2021)\nMalwarebytes researchers have discovered a financially-themed malspam campaign that distributed the remote access tool (RAT) Remcos. All of the malspam email subject lines are typical for malspam delivering a commodity tool like Remcos. Some of these subject lines include: Appraisal Report for you Loan Application-1100788392210, FWD: Reminder: Your July Appointment-11002214991. The emails refer recipients to an attached archive that, if downloaded, will enable a Visual Basic script to download and execute a Remcos payload. Researchers found metadata inside the archive inside a .hta file that included \u201cdemo\u201d in its code which researchers suggest may indicate that threat actors are testing new code.\nAnalyst Comment: Financially-themed malspam emails are a common tactic among threat actors, therefore, it is crucial that your employees are aware of their financial institutions policies regarding electronic communication. If a user is concerned due to the scare tactics often used in such emails, they should contact their financial institution via legitimate email or another form of communication.\nMITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Command-Line Interface - T1059 | REVOKED - [MITRE ATT&CK] File Permissions Modification - T1222\nTags: Malspam, VB Script, Remcos RAT\nResearchers Warn of Linux Cryptojacking Attackers Operating from Romania\n(published: July 19, 2021)\nA new cryptojacking threat group, which is likely based in Romania and has been active since at least 2020, is actively attacking Linux-based machines with weak SSH passwords, according to Bitdefender researchers. The group uses a previously-unknown SSH brute force attack tool written in Go, dubbed \u201cDiicot brute,\u201d that is reportedly being sold as a software-as-a-service (SaaS). In addition, the unnamed group is also involved in distributed denial-of-service (DDoS), which involves a variant of the DDoS botnet malware Demonbot called \u201cchernobyl.\u201d The group is primarily-motivated by mining Monero cryptocurrency via XMRig through access gained by conducting SSH brute force attacks.", "creation_timestamp": "2026-09-01T17:00:45.163963Z"}, {"uuid": "de7f7e32-bd54-4335-ae18-23a86190dc85", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3866", "content": "Threat Research\n1. CVE-2021-3438:\n16 Years In Hiding - Millions of Printers HP, Samsung, Xerox Worldwide Vulnerable\nhttps://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable\n2. Vulnerability in Apple\u2019s kernel (darwin-xnu)\nhttps://pwning.systems/posts/apple-kernel-vulnerability\n\nCloud Security\nHow to defend against DNS exfiltration in AWS?..\nhttps://towardsaws.com/how-to-defend-against-dns-exfiltration-in-aws-a65b9214d4e1\n\nexploit\nCVE-2021-33909:\nSequoia - A LPE Vulnerability in Linux\u2019s Filesystem Layer (CVE-2021-33909)\nhttps://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt\n// Tested on Ubuntu, Debian, Fedora\n\nRed Team Tactics\nHackerOne Hacker API tools\nhttps://github.com/Hacker0x01/awesome-hacker-api-tools", "creation_timestamp": "2026-09-01T17:00:45.735512Z"}, {"uuid": "eea875f0-2089-4b34-b806-ba033d1f7cfc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/hacking_Attack/17273", "content": "Black Hat Ethical Hacking\n16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows MachinesPost Views: 88 \nReading Time: 1 Minute\nResearchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines.\nIf exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights.\n\nThe bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity.\n\nAccording to researchers, the vulnerability exists in a function inside the driver that accepts data sent from User Mode via Input/Output Control (IOCTL); it does so without validating the size parameter. As the name suggests, IOCTL is a system call for device-specific input/output operations.\n\n\u201cThis function copies a string from the user input using \u2018strncpy\u2019 with a size parameter that is controlled by the user,\u201d according to SentinelOne\u2019s analysis, released on Tuesday. \u201cEssentially, this allows attackers to overrun the buffer used by the driver.\u201d\n\nThus, unprivileged users can elevate themselves into a SYSTEM account, allowing them to run code in kernel mode, since the vulnerable driver is locally available to anyone, according to the firm.\n\nThe printer-based attack vector\u00a0is perfect for cybercriminals, according to SentinelOne, since printer drivers are essentially ubiquitous on Windows machines and are automatically loaded on every startup.\nSee Also: Microsoft: New Unpatched Bug in Windows Print Spooler\n\u201cThus, in effect, this driver gets installed and loaded without even asking or notifying the user,\u201d explained the researchers. \u201cWhether you are configuring the printer to work wirelessly or via a USB cable, this driver gets loaded. In addition, it will be loaded by Windows on every boot. This makes the driver a perfect candidate to target since it will always be loaded on the machine even if there is no printer connected.\u201d\n\nWeaponizing the bug might require chaining other vulnerabilities to achieve initial access into an environment. So far, no in-the-wild attacks have been observed.\n\n\u201cWhile we haven\u2019t seen any indicators that this vulnerability has been exploited in the wild up till now, with hundreds of millions of enterprises and users currently vulnerable, it is inevitable that attackers will seek out those that do not take the appropriate action,\u201d researchers warned. How to Fix the HP Printer-Driver BugSince the bug has existed since 2005, it impacts a very long list of printer models, researchers noted; affected models and associated patches can be found here\u00a0and here.\n\nDevice-driver vulnerabilities are not uncommon, so SentinelOne also suggested reducing the attack surface with some best practices, including enforcing strong access control lists (ACLs), which control access to packages, folders, and other elements (such as services, document types and specifications) at the group level. And, it\u2019s a good idea to verify user input and not expose a generic interface to kernel mode operations, they added. See Also: Offensive Security Tool: Veil \u201cWhile HP is releasing a patch (a fixed driver), it should be noted that the certificate has not yet been revoked at the time of writing,\u201d according to SentinelOne. \u201cThis is not considered best practi[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:31.130043Z"}, {"uuid": "6f51d9b9-1369-4cf8-a39f-09f867be0baf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/hacking_Attack/17273", "content": "Black Hat Ethical Hacking\n16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows MachinesPost Views: 88 \nReading Time: 1 Minute\nResearchers have released technical details on a high-severity privilege-escalation flaw in HP printer drivers (also used by Samsung and Xerox), which impacts hundreds of millions of Windows machines.\nIf exploited, cyberattackers could bypass security products; install programs; view, change, encrypt or delete data; or create new accounts with more extensive user rights.\n\nThe bug (CVE-2021-3438) has lurked in systems for 16 years, researchers at SentinelOne said, but was only uncovered this year. It carries an 8.8 out of 10 rating on the CVSS scale, making it high-severity.\n\nAccording to researchers, the vulnerability exists in a function inside the driver that accepts data sent from User Mode via Input/Output Control (IOCTL); it does so without validating the size parameter. As the name suggests, IOCTL is a system call for device-specific input/output operations.\n\n\u201cThis function copies a string from the user input using \u2018strncpy\u2019 with a size parameter that is controlled by the user,\u201d according to SentinelOne\u2019s analysis, released on Tuesday. \u201cEssentially, this allows attackers to overrun the buffer used by the driver.\u201d\n\nThus, unprivileged users can elevate themselves into a SYSTEM account, allowing them to run code in kernel mode, since the vulnerable driver is locally available to anyone, according to the firm.\n\nThe printer-based attack vector\u00a0is perfect for cybercriminals, according to SentinelOne, since printer drivers are essentially ubiquitous on Windows machines and are automatically loaded on every startup.\nSee Also: Microsoft: New Unpatched Bug in Windows Print Spooler\n\u201cThus, in effect, this driver gets installed and loaded without even asking or notifying the user,\u201d explained the researchers. \u201cWhether you are configuring the printer to work wirelessly or via a USB cable, this driver gets loaded. In addition, it will be loaded by Windows on every boot. This makes the driver a perfect candidate to target since it will always be loaded on the machine even if there is no printer connected.\u201d\n\nWeaponizing the bug might require chaining other vulnerabilities to achieve initial access into an environment. So far, no in-the-wild attacks have been observed.\n\n\u201cWhile we haven\u2019t seen any indicators that this vulnerability has been exploited in the wild up till now, with hundreds of millions of enterprises and users currently vulnerable, it is inevitable that attackers will seek out those that do not take the appropriate action,\u201d researchers warned. How to Fix the HP Printer-Driver BugSince the bug has existed since 2005, it impacts a very long list of printer models, researchers noted; affected models and associated patches can be found here\u00a0and here.\n\nDevice-driver vulnerabilities are not uncommon, so SentinelOne also suggested reducing the attack surface with some best practices, including enforcing strong access control lists (ACLs), which control access to packages, folders, and other elements (such as services, document types and specifications) at the group level. And, it\u2019s a good idea to verify user input and not expose a generic interface to kernel mode operations, they added. See Also: Offensive Security Tool: Veil \u201cWhile HP is releasing a patch (a fixed driver), it should be noted that the certificate has not yet been revoked at the time of writing,\u201d according to SentinelOne. \u201cThis is not considered best practi[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:03:05.886430Z"}, {"uuid": "c24fbdae-c6eb-4a9c-bb5e-9760a4b259e7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3933", "content": "Blue Team Techniques\n1. Ghidra script to decrypt a string array in XOR DDoS\nhttps://maxkersten.nl/binary-analysis-course/analysis-scripts/ghidra-script-to-decrypt-a-string-array-in-xor-ddos\n2. One-stop TLS traffic inspection and manipulation using dynamic instrumentation\nhttps://blog.syss.com/posts/hallucinate\n\nOffensive security\n1. SSRF in Dependabot\nhttps://blog.tyage.net/posts/2021-06-27-dependabot-rce\n\nMalware analysis\nReverse engineer the malware Cryptowall to replicate the PE injection technique\nhttps://malwareunicorn.org/workshops/peinjection.html#0\n]-> https://github.com/malware-unicorn/GoPEInjection\n\nRed Team Tactics\n1. HTTP Server serving obfuscated Powershell Scripts/Payloads\nhttps://github.com/WazeHell/LightMe\n2. Native payload generation and shellcode injection tool that provides support for common platforms and architectures\nhttps://github.com/EntySec/HatVenom\n\nRoot Cause Analysis of a Printer\u2019s Drivers Vulnerability CVE-2021-3438\nhttps://voidsec.com/root-cause-analysis-of-cve-2021-3438\n\nexploit\nCVE-2021-24155:\nWordPress Backup Guard Authenticated RCE Exploit\nhttps://github.com/0dayNinja/CVE-2021-24155.rb", "creation_timestamp": "2026-09-02T01:04:30.811965Z"}, {"uuid": "b116ab48-2d70-4257-896f-d35cdd47941b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3917", "content": "Always check to ensure that you are downloading software from the legitimate website for the desired product.\nMITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Software Discovery - T1518 | [MITRE ATT&CK] Remote Services - T1021 | [MITRE ATT&CK] Command-Line Interface - T1059 | [MITRE ATT&CK] Standard Application Layer Protocol - T1071\nTags: Malware loader, MosaicLoader, Cracked software\nCVE-2021-3438: 16 Years in Hiding \u2013 Millions of Printers Worldwide Vulnerable\n(published: July 20, 2021)\nA high-severity vulnerability, registered as CVE-2021-3438, has been identified by SentinelLabs researchers that affects HP, Samsung, and Xerox printers. The vulnerability has resided in the printers\u2019 driver software since 2005. The number of printers created by HP, Samsung, and Xerox during the last 16 years amounts to over 380 different models by HP and Samsung and at least 12 Xerox models. Exploitation of CVE-2021-3438, which is a kernel driver vulnerability, can result in an unprivileged user account changing to \u201cSYSTEM account and run code in kernel mode (since the vulnerable driver is locally available to anyone).\u201d Researchers note that they have not seen this vulnerability actively-exploited in the wild.\nAnalyst Comment: The potential scope of this vulnerability is significant. Users should follow Security Advisories from both HP (HPSBPI03724) and Xerox (XRX21K) and apply the necessary patches as soon as possible. The list of affected HP and Samsung printer models can be found here, and the list of affected Xerox printers models can be found here.\nTags: Vulnerability, CVE-2021-3438, Printer driver software, HP, Samsung, Xerox\nRemcos RAT Delivered via Visual Basic\n(published: July 19, 2021)\nMalwarebytes researchers have discovered a financially-themed malspam campaign that distributed the remote access tool (RAT) Remcos. All of the malspam email subject lines are typical for malspam delivering a commodity tool like Remcos. Some of these subject lines include: Appraisal Report for you Loan Application-1100788392210, FWD: Reminder: Your July Appointment-11002214991. The emails refer recipients to an attached archive that, if downloaded, will enable a Visual Basic script to download and execute a Remcos payload. Researchers found metadata inside the archive inside a .hta file that included \u201cdemo\u201d in its code which researchers suggest may indicate that threat actors are testing new code.\nAnalyst Comment: Financially-themed malspam emails are a common tactic among threat actors, therefore, it is crucial that your employees are aware of their financial institutions policies regarding electronic communication. If a user is concerned due to the scare tactics often used in such emails, they should contact their financial institution via legitimate email or another form of communication.\nMITRE ATT&CK: [MITRE ATT&CK] Obfuscated Files or Information - T1027 | [MITRE ATT&CK] Command-Line Interface - T1059 | REVOKED - [MITRE ATT&CK] File Permissions Modification - T1222\nTags: Malspam, VB Script, Remcos RAT\nResearchers Warn of Linux Cryptojacking Attackers Operating from Romania\n(published: July 19, 2021)\nA new cryptojacking threat group, which is likely based in Romania and has been active since at least 2020, is actively attacking Linux-based machines with weak SSH passwords, according to Bitdefender researchers. The group uses a previously-unknown SSH brute force attack tool written in Go, dubbed \u201cDiicot brute,\u201d that is reportedly being sold as a software-as-a-service (SaaS). In addition, the unnamed group is also involved in distributed denial-of-service (DDoS), which involves a variant of the DDoS botnet malware Demonbot called \u201cchernobyl.\u201d The group is primarily-motivated by mining Monero cryptocurrency via XMRig through access gained by conducting SSH brute force attacks.", "creation_timestamp": "2026-09-02T01:04:31.861541Z"}, {"uuid": "41b5b3fb-0ac4-47b0-b8ab-86626aff342b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3438", "type": "seen", "source": "https://t.me/cissp/3866", "content": "Threat Research\n1. CVE-2021-3438:\n16 Years In Hiding - Millions of Printers HP, Samsung, Xerox Worldwide Vulnerable\nhttps://labs.sentinelone.com/cve-2021-3438-16-years-in-hiding-millions-of-printers-worldwide-vulnerable\n2. Vulnerability in Apple\u2019s kernel (darwin-xnu)\nhttps://pwning.systems/posts/apple-kernel-vulnerability\n\nCloud Security\nHow to defend against DNS exfiltration in AWS?..\nhttps://towardsaws.com/how-to-defend-against-dns-exfiltration-in-aws-a65b9214d4e1\n\nexploit\nCVE-2021-33909:\nSequoia - A LPE Vulnerability in Linux\u2019s Filesystem Layer (CVE-2021-33909)\nhttps://www.qualys.com/2021/07/20/cve-2021-33909/sequoia-local-privilege-escalation-linux.txt\n// Tested on Ubuntu, Debian, Fedora\n\nRed Team Tactics\nHackerOne Hacker API tools\nhttps://github.com/Hacker0x01/awesome-hacker-api-tools", "creation_timestamp": "2026-09-02T01:04:32.588710Z"}]}