{"vulnerability": "CVE-2021-31727", "sightings": [{"uuid": "ff063b82-d03a-41c1-84c9-30df3306800e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31727", "type": "seen", "source": "https://t.me/arpsyndicate/2729", "content": "#ExploitObserverAlert\n\nCVE-2021-31727\n\nDESCRIPTION: Exploit Observer has 5 entries related to CVE-2021-31727. Incorrect access control in zam64.sys, zam32.sys in MalwareFox AntiMalware 2.74.0.150 where IOCTL's 0x80002014, 0x80002018 expose unrestricted disk read/write capabilities respectively. A non-privileged process can open a handle to \\.\\ZemanaAntiMalware, register with the driver using IOCTL 0x80002010 and send these IOCTL's to escalate privileges by overwriting the boot sector or overwriting critical code in the pagefile.\n\nFIRST-EPSS: 0.000440000\nNVD-IS: 5.9\nNVD-ES: 1.8", "creation_timestamp": "2024-01-09T07:47:08.000000Z"}, {"uuid": "b9e5d171-a40d-4567-aefc-ee2e151cc65e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31727", "type": "published-proof-of-concept", "source": "https://t.me/CyberSecurityTechnologies/3325", "content": "#exploit\nCVE-2021-31727, CVE-2021-31728:\nVulnerability in zam64.sys, zam32.sys allowing ring 0 code execution\nhttps://github.com/irql0/CVE-2021-31728", "creation_timestamp": "2024-02-17T14:55:47.000000Z"}, {"uuid": "867b5ee8-94cb-473e-9996-572f42405a98", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31727", "type": "seen", "source": "https://t.me/cissp/3150", "content": "exploit\nCVE-2021-31727, CVE-2021-31728:\nVulnerability in zam64.sys, zam32.sys allowing ring 0 code execution\nhttps://github.com/irql0/CVE-2021-31728\n\nBlue Team Techniques\nIncident Response Playbooks\n1. Phishing investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-phishing\n2. Password spray investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-password-spray\n3. App consent grant investigation\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-app-consent\n\nThreat Research\nSix CVEs, 0click RCEs on computers running the latest version of RemoteMouse application and server (0-day)\nhttps://axelp.io/MouseTrap\n]-> PoCs:\nhttps://github.com/CuckooEXE/MouseTrap\n\nRed Team Tactics\n1. Super fast login WordPress Brute Force\ud83d\ude01\nhttps://github.com/22XploiterCrew-Team/WordPress-Brute-Force\n2. Pwninit - automate starting binary exploit challenges\nhttps://github.com/io12/pwninit\n3. Bypassing EDR real-time injection detection logic\nhttps://blog.redbluepurple.io/offensive-research/bypassing-injection-detection\n\nWLAN Security\nCVE-2021-32030:\nASUS GT-AC2900 Dual Band WiFi Router - Authentication Bypass (PoC)\nhttps://www.atredis.com/blog/2021/4/30/asus-authentication-bypass", "creation_timestamp": "2026-09-01T17:00:50.646040Z"}, {"uuid": "4a1c042d-7b62-4bf8-a20b-d54dd082c7d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31727", "type": "seen", "source": "https://t.me/cissp/3150", "content": "exploit\nCVE-2021-31727, CVE-2021-31728:\nVulnerability in zam64.sys, zam32.sys allowing ring 0 code execution\nhttps://github.com/irql0/CVE-2021-31728\n\nBlue Team Techniques\nIncident Response Playbooks\n1. Phishing investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-phishing\n2. Password spray investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-password-spray\n3. App consent grant investigation\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-app-consent\n\nThreat Research\nSix CVEs, 0click RCEs on computers running the latest version of RemoteMouse application and server (0-day)\nhttps://axelp.io/MouseTrap\n]-> PoCs:\nhttps://github.com/CuckooEXE/MouseTrap\n\nRed Team Tactics\n1. Super fast login WordPress Brute Force\ud83d\ude01\nhttps://github.com/22XploiterCrew-Team/WordPress-Brute-Force\n2. Pwninit - automate starting binary exploit challenges\nhttps://github.com/io12/pwninit\n3. Bypassing EDR real-time injection detection logic\nhttps://blog.redbluepurple.io/offensive-research/bypassing-injection-detection\n\nWLAN Security\nCVE-2021-32030:\nASUS GT-AC2900 Dual Band WiFi Router - Authentication Bypass (PoC)\nhttps://www.atredis.com/blog/2021/4/30/asus-authentication-bypass", "creation_timestamp": "2026-09-02T01:04:39.659397Z"}, {"uuid": "dc207dbb-1c7b-4b62-adf5-f7e906127212", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31727", "type": "seen", "source": "https://t.me/cissp/3150", "content": "exploit\nCVE-2021-31727, CVE-2021-31728:\nVulnerability in zam64.sys, zam32.sys allowing ring 0 code execution\nhttps://github.com/irql0/CVE-2021-31728\n\nBlue Team Techniques\nIncident Response Playbooks\n1. Phishing investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-phishing\n2. Password spray investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-password-spray\n3. App consent grant investigation\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-app-consent\n\nThreat Research\nSix CVEs, 0click RCEs on computers running the latest version of RemoteMouse application and server (0-day)\nhttps://axelp.io/MouseTrap\n]-> PoCs:\nhttps://github.com/CuckooEXE/MouseTrap\n\nRed Team Tactics\n1. Super fast login WordPress Brute Force\ud83d\ude01\nhttps://github.com/22XploiterCrew-Team/WordPress-Brute-Force\n2. Pwninit - automate starting binary exploit challenges\nhttps://github.com/io12/pwninit\n3. Bypassing EDR real-time injection detection logic\nhttps://blog.redbluepurple.io/offensive-research/bypassing-injection-detection\n\nWLAN Security\nCVE-2021-32030:\nASUS GT-AC2900 Dual Band WiFi Router - Authentication Bypass (PoC)\nhttps://www.atredis.com/blog/2021/4/30/asus-authentication-bypass", "creation_timestamp": "2026-09-11T07:00:05.146008Z"}, {"uuid": "83ac2acc-ed86-48b5-b698-4d9799e7557e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-31727", "type": "seen", "source": "https://t.me/cissp/3150", "content": "exploit\nCVE-2021-31727, CVE-2021-31728:\nVulnerability in zam64.sys, zam32.sys allowing ring 0 code execution\nhttps://github.com/irql0/CVE-2021-31728\n\nBlue Team Techniques\nIncident Response Playbooks\n1. Phishing investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-phishing\n2. Password spray investigation\ud83d\udc4d\ud83c\udffd\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-password-spray\n3. App consent grant investigation\nhttps://docs.microsoft.com/ru-ru/security/compass/incident-response-playbook-app-consent\n\nThreat Research\nSix CVEs, 0click RCEs on computers running the latest version of RemoteMouse application and server (0-day)\nhttps://axelp.io/MouseTrap\n]-> PoCs:\nhttps://github.com/CuckooEXE/MouseTrap\n\nRed Team Tactics\n1. Super fast login WordPress Brute Force\ud83d\ude01\nhttps://github.com/22XploiterCrew-Team/WordPress-Brute-Force\n2. Pwninit - automate starting binary exploit challenges\nhttps://github.com/io12/pwninit\n3. Bypassing EDR real-time injection detection logic\nhttps://blog.redbluepurple.io/offensive-research/bypassing-injection-detection\n\nWLAN Security\nCVE-2021-32030:\nASUS GT-AC2900 Dual Band WiFi Router - Authentication Bypass (PoC)\nhttps://www.atredis.com/blog/2021/4/30/asus-authentication-bypass", "creation_timestamp": "2026-09-12T00:00:49.577352Z"}]}