Описание
Windows Update Orchestrator Service Security Feature Bypass Vulnerability
Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.
FAQ
What kind of security feature could be bypassed by successfully exploiting this vulnerability? Successful exploitation could bypass provider-registration validation in Windows Update Orchestrator, allowing a local authenticated attacker to register unauthorized provider state.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Windows Server 2022 | ||
| Windows Server 2022 (Server Core installation) | ||
| Windows 10 Version 21H2 for 32-bit Systems | ||
| Windows 10 Version 21H2 for ARM64-based Systems | ||
| Windows 10 Version 21H2 for x64-based Systems | ||
| Windows 10 Version 22H2 for x64-based Systems | ||
| Windows 10 Version 22H2 for ARM64-based Systems | ||
| Windows 10 Version 22H2 for 32-bit Systems | ||
| Windows 11 Version 23H2 for ARM64-based Systems | ||
| Windows 11 Version 23H2 for x64-based Systems |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
EPSS
5.5 Medium
CVSS3
Связанные уязвимости
Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.
Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally.
EPSS
5.5 Medium
CVSS3