CVE-2021-40464 is a high-severity Elevation of Privilege vulnerability affecting Windows Nearby Sharing across various Windows versions, including Windows 10, 11, and Server editions. This vulnerability, with a CVSS score of 8.0, allows a local, authenticated attacker on the same network (adjacent) to gain high privileges with no user interaction, leading to complete compromise of confidentiality, integrity, and availability. While no public exploit code (Metasploit, Nuclei, ExploitDB) is currently available and it's not listed in CISA's KEV catalog, it received some media coverage during Microsoft's October 2021 Patch Tuesday.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
20h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:* | ||
20h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:* | ||
20h2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:* | ||
21h1CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:* | ||
21h1CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.