CVE-2004-0210

CVE-2004-0210 is a memory-safety flaw (CWE-120, buffer overflow) in the POSIX subsystem of Microsoft Windows that allows a user who is already logged on to elevate privileges and take complete control of the affected system. It is triggered by a local, logged-on user sending crafted input to the POSIX subsystem, so exploitation requires the ability to execute code on the host rather than network access. A successful attacker gains SYSTEM-level control, fully compromising the machine and typically using the escalation to turn a limited account into full administrative access as part of a broader intrusion or ransomware chain. The flaw affects Windows versions that shipped the vulnerable POSIX subsystem — historically Windows NT 4.0, Windows 2000, and Windows XP per Microsoft's MS04-020 bulletin — while CISA lists the affected product broadly as 'Microsoft Windows'. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2022-03-03, confirming exploitation in the wild (ransomware use unknown); EPSS estimates a 7.2% probability of exploitation within 30 days (94th percentile), no public proof-of-concept is known, and CVSS has not yet been scored.

What to do: Apply Microsoft's POSIX subsystem security update (MS04-020) per vendor instructions on any Windows NT 4.0, Windows 2000, or Windows XP system still in service, prioritizing multi-user hosts such as terminal servers, shared workstations, and jump boxes where untrusted users can log on locally. Federal agencies must remediate per CISA's KEV/BOD 22-01 timelines; where legacy systems cannot be patched, restrict interactive logon to trusted users, disable or remove the POSIX subsystem if unused, and monitor for signs of local SYSTEM-level escalation.