Group Policy Elevation of Privilege Vulnerability in Microsoft Windows
CVE-2016-3223

8.1HIGH

Key Information:

Vendor

Microsoft
Status
Windows Rt 8.1
Windows Server 2012
Windows 7
Windows 10
Vendor
CVE Published:
16 June 2016

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 21%

What is CVE-2016-3223?

This vulnerability occurs in several versions of Microsoft Windows where LDAP authentication is improperly managed. It allows attackers to exploit the way group-policy updates are processed. By manipulating this data stream within a domain controller, an attacker can escalate privileges, potentially leading to unauthorized access or control over system resources. Organizations utilizing affected versions of Windows should apply security updates promptly to mitigate this risk.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2016-3223 - Proof of Concept

CVE-2016-3223
Created by HORKimhab

References

http://packetstormsecurity.com/files/138248/Microsoft-Win...
x_refsource_MISC
https://docs.microsoft.com/en-us/security-updates/securit...
vendor-advisoryx_refsource_MS
http://www.securitytracker.com/id/1036100
vdb-entryx_refsource_SECTRACK

EPSS Score

21% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.