Windows Digital TV Tuner device registration application Elevation of Privilege Vulnerability

The remote Windows host is missing security update 5005089 or cumulative update 5005088. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-34483, CVE-2021-34484,     CVE-2021-34537, CVE-2021-36927)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-34533, CVE-2021-34535, CVE-2021-36936,     CVE-2021-36937, CVE-2021-36947)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

The remote Windows host is missing security update 5005106 or cumulative update 5005076. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,     CVE-2021-34484, CVE-2021-34537, CVE-2021-36927)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-26432, CVE-2021-34533, CVE-2021-34535,     CVE-2021-36936, CVE-2021-36937, CVE-2021-36947)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-26433, CVE-2021-36926,     CVE-2021-36932, CVE-2021-36933)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

The remote Windows host is missing security update 5005095 or cumulative update 5005090. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-34533, CVE-2021-36936, CVE-2021-36937,     CVE-2021-36947)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-34483, CVE-2021-34484,     CVE-2021-36927)

The remote Windows host is missing security update 5005094 or cumulative update 5005099. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-26425, CVE-2021-26426, CVE-2021-34483,     CVE-2021-34484, CVE-2021-36927)

  - A session spoofing vulnerability exists. An attacker can     exploit this to perform actions with the privileges of     another user. (CVE-2021-36942)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-26424,     CVE-2021-26432, CVE-2021-34533, CVE-2021-34535,     CVE-2021-36936, CVE-2021-36937, CVE-2021-36947)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-26433, CVE-2021-36926,     CVE-2021-36932, CVE-2021-36933)

  - An memory corruption vulnerability exists. An attacker     can exploit this to corrupt the memory and cause     unexpected behaviors within the system/application.
    (CVE-2021-34480)

ID	Name	Product	Family	Severity
152436	KB5005089: Windows 7 and Windows Server 2008 R2 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152433	KB5005106: Windows 8.1 and Windows Server 2012 R2 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152425	KB5005095: Windows Server 2008 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical
152421	KB5005094: Windows Server 2012 Security Update (August 2021)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2021-36927

high

Tenable Plugins

critical

critical

critical

critical