{"vulnerability": "CVE-2021-3808", "sightings": [{"uuid": "2649ad91-4c86-4f92-847f-8a04b92fd5c0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "596f625b-8237-4ffe-8294-c9be599054c7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "c2b89f44-2d70-4e80-9e15-b002ca72aaf0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/canon_driver_privesc.rb", "content": "", "creation_timestamp": "2021-08-11T20:12:50.000000Z"}, {"uuid": "b3fb9ab8-5bf2-48e8-b3ca-2362dc3533d9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/348", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aProof-of-Concept (PoC) script to exploit Pulse Secure CVE-2021-22893. \nURL\uff1ahttps://github.com/AlAIAL90/CVE-2021-38085", "creation_timestamp": "2021-08-20T02:37:24.000000Z"}, {"uuid": "cbef1293-7730-41eb-8084-c1f3b32b506d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3808", "type": "seen", "source": "https://t.me/secmedia/348", "content": "HP \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b\u0430 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f BIOS \u0434\u043b\u044f \u0443\u0441\u0442\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0434\u0432\u0443\u0445 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0445 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2021-3808 \u0438 CVE-2021-3809 \u0438 \u0438\u043c\u0435\u044e\u0442 \u0431\u0430\u043b\u043b 8,8 \u043f\u043e \u0441\u0438\u0441\u0442\u0435\u043c\u0435 CVSS 3.1.", "creation_timestamp": "2022-05-12T08:38:22.000000Z"}, {"uuid": "54ad3845-6739-4761-8958-202f092b9dbd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3808", "type": "seen", "source": "https://t.me/true_secator/2933", "content": "\u0412\u0441\u043b\u0435\u0434 \u0437\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u043c\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0446\u0435\u043b\u044b\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 UEFI \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 HP \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 BIOS.\n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e\u0432\u043e\u0434\u043e\u043c \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u0438 \u0434\u0432\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 200 \u043c\u043e\u0434\u0435\u043b\u044f\u0445 \u041f\u041a \u0438 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u043c\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a BIOS.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2021-3808 \u0438 CVE-2021-3809, \u0438 \u0438\u043c\u0435\u044e\u0442 \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 8,8.\u00a0\u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 HP \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u044f\u0432\u043b\u044f\u044f \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0432 \u0447\u0438\u0441\u043b\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0432\u0445\u043e\u0434\u044f\u0442 \u0431\u0438\u0437\u043d\u0435\u0441-\u043d\u043e\u0443\u0442\u0431\u0443\u043a\u0438 Zbook Studio, ZHAN Pro, EliteBook, ProBook \u0438 Elite Dragonfly, \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0435 \u041f\u041a EliteDesk \u0438 ProDesk, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b PoS Engage, \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 Z1 \u0438 Z2 \u0438 \u0442\u043e\u043d\u043a\u0438\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0435 \u041f\u041a.\n\u00a0\n\u0411\u0430\u0433\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0435\u0449\u0435 \u043d\u043e\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u041d\u0438\u043a\u043e\u043b\u0430\u0441\u0443 \u0421\u0442\u0430\u0440\u043a\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u044f\u0441\u043d\u0438\u043b \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u043c\u0443 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0443\u0440\u043e\u0432\u043d\u044f \u044f\u0434\u0440\u0430 (CPL == 0), \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0440\u0435\u0436\u0438\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 (SMM).\u00a0\u041f\u0440\u0438 \u044d\u0442\u043e\u043c SMM \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430\u0434 \u0445\u043e\u0441\u0442\u043e\u043c \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a SMI \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u0441\u0440\u0435\u0434\u044b \u041e\u0421, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u044f\u0434\u0440\u0430 Windows. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0430\u0434\u0440\u0435\u0441 \u043f\u0430\u043c\u044f\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 LocateProtocol \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c.\u00a0\u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430, \u0434\u0430\u0432 \u043d\u0430 \u044d\u0442\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0443 SMI.\n\n\u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u043c\u0435\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0443\u0440\u043e\u0432\u043d\u044f root/SYSTEM \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 (SMM). \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, y\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0434\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 HP \u0438\u043c\u0435\u044e\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043b\u044f \u043e\u0431\u043e\u0439\u0442\u0438, \u0447\u0442\u043e\u0431\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 HP Sure Start, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442 \u0445\u043e\u0441\u0442 \u043f\u0440\u0438 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0438 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u041f\u0440\u0438 \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0446\u0435\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 UEFI (BIOS), \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0433\u043e \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u0432\u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u041e\u0421.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u0432\u0441\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0436\u0435\u043b\u0435\u0437\u0430 \u041d\u0420, \u043d\u0435 \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c \u0441\u0442\u0430\u0442\u044c \u0447\u0430\u0441\u0442\u044c\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0410\u0420\u0422, \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c UEFI, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c BIOS, \u043f\u043e\u043a\u0430 \u0435\u0433\u043e \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0431\u0435\u0437 \u0432\u0430\u0448\u0435\u0433\u043e \u0443\u0447\u0430\u0441\u0442\u0438\u044f.", "creation_timestamp": "2022-05-12T16:40:05.000000Z"}, {"uuid": "bbb4c575-1e87-4afb-99f0-77e812a83094", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3808", "type": "seen", "source": "https://t.me/cibsecurity/57267", "content": "\u203c CVE-2021-3808 \u203c\n\nPotential security vulnerabilities have been identified in the BIOS (UEFI Firmware) for certain HP PC products, which might allow arbitrary code execution. HP is releasing firmware updates to mitigate these potential vulnerabilities.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-02-01T12:14:10.000000Z"}, {"uuid": "d1c1d190-9a1a-43fe-bd75-b26910ef9717", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38086", "type": "seen", "source": "https://t.me/cibsecurity/27230", "content": "\u203c CVE-2021-38086 \u203c\n\nAcronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacking.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T18:39:55.000000Z"}, {"uuid": "08177852-22de-41f9-a471-f42de3a046fe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38087", "type": "seen", "source": "https://t.me/cibsecurity/27225", "content": "\u203c CVE-2021-38087 \u203c\n\nReflected cross-site scripting (XSS) was possible on the login page in Acronis Cyber Protect 15 prior to build 27009.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T18:39:48.000000Z"}, {"uuid": "a87076f0-b0ee-4e0a-8638-36680974d9a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38088", "type": "seen", "source": "https://t.me/cibsecurity/27235", "content": "\u203c CVE-2021-38088 \u203c\n\nAcronis Cyber Protect 15 for Windows prior to build 27009 allowed local privilege escalation via binary hijacking.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-12T18:40:02.000000Z"}, {"uuid": "e644c017-9e1a-4df8-9ed0-94b42d57b6c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "seen", "source": "https://t.me/cibsecurity/27184", "content": "\u203c CVE-2021-38085 \u203c\n\nThe Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process).\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-08-11T22:38:39.000000Z"}, {"uuid": "3fbae505-ab9c-4916-8461-9001f3a45149", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3808", "type": "seen", "source": "https://t.me/S_E_Reborn/2203", "content": "\u0412\u0441\u043b\u0435\u0434 \u0437\u0430 \u043d\u0435\u0434\u0430\u0432\u043d\u0438\u043c\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f\u043c\u0438 \u0446\u0435\u043b\u044b\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 UEFI \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u0434\u0438\u0442\u0435\u043b\u044c \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 HP \u0432\u044b\u043f\u0443\u0441\u043a\u0430\u0435\u0442 \u043d\u043e\u0432\u043e\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 BIOS.\n\n\u041d\u0430 \u044d\u0442\u043e\u0442 \u0440\u0430\u0437 \u043f\u043e\u0432\u043e\u0434\u043e\u043c \u043f\u043e\u0441\u043b\u0443\u0436\u0438\u043b\u0438 \u0434\u0432\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u044e\u0449\u0438\u0435 \u0448\u0438\u0440\u043e\u043a\u0438\u0439 \u0441\u043f\u0435\u043a\u0442\u0440 \u0432 \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 200 \u043c\u043e\u0434\u0435\u043b\u044f\u0445 \u041f\u041a \u0438 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u043e\u0434 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u044f\u0434\u0440\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u0435 \u0434\u0440\u0430\u0439\u0432\u0435\u0440\u0430\u043c\u0438 \u0438 \u0434\u043e\u0441\u0442\u0443\u043f \u043a BIOS.\n\n\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u043e\u0442\u0441\u043b\u0435\u0436\u0438\u0432\u0430\u044e\u0442\u0441\u044f \u043a\u0430\u043a CVE-2021-3808 \u0438 CVE-2021-3809, \u0438 \u0438\u043c\u0435\u044e\u0442 \u0431\u0430\u0437\u043e\u0432\u0443\u044e \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 8,8.\u00a0\u041d\u0430 \u0434\u0430\u043d\u043d\u044b\u0439 \u043c\u043e\u043c\u0435\u043d\u0442 HP \u043d\u0435 \u0440\u0430\u0441\u043a\u0440\u044b\u0432\u0430\u0435\u0442 \u0442\u0435\u0445\u043d\u0438\u0447\u0435\u0441\u043a\u0438\u0445 \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0435\u0439, \u0437\u0430\u044f\u0432\u043b\u044f\u044f \u043b\u0438\u0448\u044c, \u0447\u0442\u043e \u0432 \u0447\u0438\u0441\u043b\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0445 \u043f\u0440\u043e\u0434\u0443\u043a\u0442\u043e\u0432 \u0432\u0445\u043e\u0434\u044f\u0442 \u0431\u0438\u0437\u043d\u0435\u0441-\u043d\u043e\u0443\u0442\u0431\u0443\u043a\u0438 Zbook Studio, ZHAN Pro, EliteBook, ProBook \u0438 Elite Dragonfly, \u043d\u0430\u0441\u0442\u043e\u043b\u044c\u043d\u044b\u0435 \u041f\u041a EliteDesk \u0438 ProDesk, \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u044b PoS Engage, \u0440\u0430\u0431\u043e\u0447\u0438\u0435 \u0441\u0442\u0430\u043d\u0446\u0438\u0438 Z1 \u0438 Z2 \u0438 \u0442\u043e\u043d\u043a\u0438\u0435 \u043a\u043b\u0438\u0435\u043d\u0442\u0441\u043a\u0438\u0435 \u041f\u041a.\n\u00a0\n\u0411\u0430\u0433\u0438 \u0431\u044b\u043b\u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u0435\u0449\u0435 \u043d\u043e\u044f\u0431\u0440\u0435 2021 \u0433\u043e\u0434\u0430 \u0431\u043b\u0430\u0433\u043e\u0434\u0430\u0440\u044f \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u041d\u0438\u043a\u043e\u043b\u0430\u0441\u0443 \u0421\u0442\u0430\u0440\u043a\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043f\u043e\u044f\u0441\u043d\u0438\u043b \u0432 \u0441\u0432\u043e\u0435\u043c \u0431\u043b\u043e\u0433\u0435, \u0447\u0442\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0436\u0435\u0442 \u043f\u043e\u0437\u0432\u043e\u043b\u0438\u0442\u044c \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443, \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0435\u043c\u0443 \u0441 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u044f\u043c\u0438 \u0443\u0440\u043e\u0432\u043d\u044f \u044f\u0434\u0440\u0430 (CPL == 0), \u043f\u043e\u0432\u044b\u0441\u0438\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0434\u043e \u0440\u0435\u0436\u0438\u043c\u0430 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 (SMM).\u00a0\u041f\u0440\u0438 \u044d\u0442\u043e\u043c SMM \u0434\u0430\u0435\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043f\u043e\u043b\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u043d\u0430\u0434 \u0445\u043e\u0441\u0442\u043e\u043c \u0434\u043b\u044f \u0434\u0430\u043b\u044c\u043d\u0435\u0439\u0448\u0438\u0445 \u0430\u0442\u0430\u043a.\n\n\u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0437\u0430\u043a\u043b\u044e\u0447\u0430\u0435\u0442\u0441\u044f \u0432 \u0442\u043e\u043c, \u0447\u0442\u043e \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a SMI \u043c\u043e\u0436\u0435\u0442 \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c\u0441\u044f \u0438\u0437 \u0441\u0440\u0435\u0434\u044b \u041e\u0421, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0447\u0435\u0440\u0435\u0437 \u0434\u0440\u0430\u0439\u0432\u0435\u0440 \u044f\u0434\u0440\u0430 Windows. \u041f\u043e\u044d\u0442\u043e\u043c\u0443 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u043d\u0430\u0439\u0442\u0438 \u0430\u0434\u0440\u0435\u0441 \u043f\u0430\u043c\u044f\u0442\u0438 \u0444\u0443\u043d\u043a\u0446\u0438\u0438 LocateProtocol \u0438 \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0442\u044c \u0435\u0433\u043e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u043c \u043a\u043e\u0434\u043e\u043c.\u00a0\u041e\u043d \u043c\u043e\u0436\u0435\u0442 \u0438\u043d\u0438\u0446\u0438\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430, \u0434\u0430\u0432 \u043d\u0430 \u044d\u0442\u043e \u043a\u043e\u043c\u0430\u043d\u0434\u0443 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0443 SMI.\n\n\u0414\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0438\u043c\u0435\u0442\u044c \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0443\u0440\u043e\u0432\u043d\u044f root/SYSTEM \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0442\u044c \u043a\u043e\u0434 \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u0443\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u0438\u044f \u0441\u0438\u0441\u0442\u0435\u043c\u043e\u0439 (SMM). \u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, y\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0434\u0435\u043b\u0438 \u043a\u043e\u043c\u043f\u044c\u044e\u0442\u0435\u0440\u043e\u0432 HP \u0438\u043c\u0435\u044e\u0442 \u0441\u0440\u0435\u0434\u0441\u0442\u0432\u0430 \u0437\u0430\u0449\u0438\u0442\u044b, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0443 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e \u0434\u043b\u044f \u043e\u0431\u043e\u0439\u0442\u0438, \u0447\u0442\u043e\u0431\u044b \u044d\u043a\u0441\u043f\u043b\u043e\u0439\u0442 \u0441\u0440\u0430\u0431\u043e\u0442\u0430\u043b, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0441\u0438\u0441\u0442\u0435\u043c\u0430 HP Sure Start, \u043a\u043e\u0442\u043e\u0440\u0430\u044f \u043e\u0442\u043a\u043b\u044e\u0447\u0438\u0442 \u0445\u043e\u0441\u0442 \u043f\u0440\u0438 \u043f\u043e\u0432\u0440\u0435\u0436\u0434\u0435\u043d\u0438\u0438 \u043f\u0430\u043c\u044f\u0442\u0438.\n\n\u041f\u0440\u0438 \u0434\u043e\u0441\u0442\u0438\u0436\u0435\u043d\u0438\u0438 \u043a\u043e\u043d\u0435\u0447\u043d\u043e\u0439 \u0446\u0435\u043b\u0438 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a, \u043f\u0435\u0440\u0435\u0437\u0430\u043f\u0438\u0441\u0430\u0432 UEFI (BIOS), \u043c\u043e\u0436\u0435\u0442 \u0434\u043e\u0431\u0438\u0442\u044c\u0441\u044f \u0443\u0441\u0442\u043e\u0439\u0447\u0438\u0432\u043e\u0433\u043e \u0437\u0430\u043a\u0440\u0435\u043f\u043b\u0435\u043d\u0438\u044f \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u043e\u0433\u043e \u041f\u041e \u043d\u0430 \u043c\u0430\u0448\u0438\u043d\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u043d\u0435\u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e \u0431\u0443\u0434\u0435\u0442 \u0432\u043f\u043e\u0441\u043b\u0435\u0434\u0441\u0442\u0432\u0438\u0438 \u0443\u0434\u0430\u043b\u0438\u0442\u044c \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u0430\u043d\u0442\u0438\u0432\u0438\u0440\u0443\u0441\u043d\u044b\u0445 \u0441\u0440\u0435\u0434\u0441\u0442\u0432 \u0438\u043b\u0438 \u043f\u0435\u0440\u0435\u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u041e\u0421.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u0432\u0441\u0435\u043c \u0432\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0436\u0435\u043b\u0435\u0437\u0430 \u041d\u0420, \u043d\u0435 \u0436\u0435\u043b\u0430\u044e\u0449\u0438\u043c \u0441\u0442\u0430\u0442\u044c \u0447\u0430\u0441\u0442\u044c\u044e \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0439 \u0410\u0420\u0422, \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0443\u044e\u0449\u0438\u0445 \u0430\u0442\u0430\u043a\u0438 \u043f\u043e\u0441\u0440\u0435\u0434\u0441\u0442\u0432\u043e\u043c UEFI, \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u043c \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c BIOS, \u043f\u043e\u043a\u0430 \u0435\u0433\u043e \u043d\u0435 \u043e\u0431\u043d\u043e\u0432\u0438\u043b\u0438 \u0431\u0435\u0437 \u0432\u0430\u0448\u0435\u0433\u043e \u0443\u0447\u0430\u0441\u0442\u0438\u044f.", "creation_timestamp": "2022-05-12T18:50:55.000000Z"}, {"uuid": "327c03d5-5011-4c1a-b08b-6542addb0b2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3808", "type": "seen", "source": "https://t.me/EchelonEyes/266", "content": "HP \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0432\u0448\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 200 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439\n\n\u0412\u0435\u043d\u0434\u043e\u0440 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 UEFI \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 200 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2013 CVE-2021-3808 \u0438 CVE-2021-3809. \u041e\u0431\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 8,8 \u0438\u0437 10 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 UEFI. \n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d \u0432 \u0442\u0435\u043a\u0441\u0442\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 HP.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438: \n\nhttps://support.hp.com/us-en/document/ish_6184733-6184761-16/hpsbhf03788\n\nhttps://nstarke.github.io/uefi/smm/2022/05/10/smm-callout-in-hp-products.html \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #HP", "creation_timestamp": "2026-07-17T05:00:05.195528Z"}, {"uuid": "45602c4a-ec80-4888-ac11-1fbe6a60c07a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3808", "type": "published-proof-of-concept", "source": "https://t.me/EchelonEyes/266", "content": "HP \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u043b \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438, \u0437\u0430\u0442\u0440\u043e\u043d\u0443\u0432\u0448\u0438\u0435 \u0431\u043e\u043b\u0435\u0435 200 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439\n\n\u0412\u0435\u043d\u0434\u043e\u0440 \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 UEFI \u0434\u043b\u044f \u0431\u043e\u043b\u0435\u0435 \u0447\u0435\u043c 200 \u043c\u043e\u0434\u0435\u043b\u0435\u0439 \u043d\u043e\u0443\u0442\u0431\u0443\u043a\u043e\u0432 \u0438 \u0440\u0430\u0431\u043e\u0447\u0438\u0445 \u0441\u0442\u0430\u043d\u0446\u0438\u0439, \u0447\u0442\u043e\u0431\u044b \u0443\u0441\u0442\u0440\u0430\u043d\u0438\u0442\u044c \u0434\u0432\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u2013 CVE-2021-3808 \u0438 CVE-2021-3809. \u041e\u0431\u0435 \u043f\u043e\u043b\u0443\u0447\u0438\u043b\u0438 \u043e\u0446\u0435\u043d\u043a\u0443 CVSS 8,8 \u0438\u0437 10 \u0438 \u0441\u0432\u044f\u0437\u0430\u043d\u044b \u0441 \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u043e\u0438\u0437\u0432\u043e\u043b\u044c\u043d\u043e\u0433\u043e \u043a\u043e\u0434\u0430 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438 \u0432 \u0441\u0438\u0441\u0442\u0435\u043c\u0430\u0445 \u0441 \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u043c\u0438 \u0432\u0435\u0440\u0441\u0438\u044f\u043c\u0438 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0438 UEFI. \n\n\u041f\u043e\u043b\u043d\u044b\u0439 \u0441\u043f\u0438\u0441\u043e\u043a \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432, \u0432 \u043f\u0440\u043e\u0448\u0438\u0432\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u044b \u043d\u0435\u0434\u043e\u0441\u0442\u0430\u0442\u043a\u0438, \u043f\u0440\u0438\u0432\u0435\u0434\u0435\u043d \u0432 \u0442\u0435\u043a\u0441\u0442\u0435 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u043e\u043d\u043d\u043e\u0433\u043e \u0441\u043e\u043e\u0431\u0449\u0435\u043d\u0438\u044f \u043d\u0430 \u0441\u0430\u0439\u0442\u0435 HP.\n\n\u0418\u0441\u0442\u043e\u0447\u043d\u0438\u043a\u0438: \n\nhttps://support.hp.com/us-en/document/ish_6184733-6184761-16/hpsbhf03788\n\nhttps://nstarke.github.io/uefi/smm/2022/05/10/smm-callout-in-hp-products.html \n\n#\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c #HP", "creation_timestamp": "2026-07-18T00:00:37.711017Z"}, {"uuid": "71210e6c-833d-4985-8737-05a0fa5ec7d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "seen", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.516012Z"}, {"uuid": "41ff2f7a-10bb-49a5-9113-fe6eb89559f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "seen", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-01T20:02:22.494463Z"}, {"uuid": "d9690d96-be24-45f9-bd4b-7fca60c4f9c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T13:00:05.120797Z"}, {"uuid": "741b6527-6258-4644-90fe-505114e3b268", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-38085", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-07T15:00:06.810812Z"}]}