Microsoft Intune Management Extension < 1.41.203.0 (CVE-2021-31980)

high Nessus Plugin ID 243954

Language:

Synopsis

An instance of IME installed on the system is missing a security update.

Description

Remote code execution vulnerability in the Microsoft Intune Management Extension < 1.41.203.0. The vulnerability allows an unauthenticated attacker to execute arbitrary code on a target machine over the network.

Solution

Upgrade to Intune Management Extension 1.41.203.0 or later.

Plugin Details

Severity: High

ID: 243954

File Name: microsoft_ime_cve-2021-31980.nasl

Version: 1.2

Type: local

Agent: windows

Family: Windows

Published: 8/6/2025

Updated: 11/17/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:microsoft:intune_management_extension

Required KB Items: installed_sw/Intune Management Extension

Patch Publication Date: 6/8/2021

Vulnerability Publication Date: 6/8/2021

Reference Information

CVE: CVE-2021-31980

Detections

Analytics