CISA adds 95 flaws to the Known Exploited Vulnerabilities Catalog

CVE-2002-0367 is a local privilege escalation flaw in the debugging subsystem of Microsoft Windows, in which the component associated with smss.exe does not properly authenticate programs that connect to other programs. A local attacker can exploit it by attaching to a process running with elevated rights, causing the unverified debugging connection to be accepted. Successful exploitation grants administrator or SYSTEM privileges on the affected machine, enabling full system control, credential theft, and follow-on activity such as ransomware deployment. All Microsoft Windows systems covered by CISA's advisory are affected; the source data does not specify exact version ranges, so defenders should consult the vendor advisory for scope. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, indicating confirmed in-the-wild exploitation, with no public proof-of-concept identified and an EPSS 30-day exploitation probability of 4.9% (92nd percentile).

Do: Apply Microsoft updates per vendor instructions, as required by CISA following the 2022-03-03 KEV listing. Because exploitation requires local access, restrict interactive logon and local program-installation rights on Windows systems, and audit legacy hosts to confirm the debugging-subsystem patch is installed.

CVE-2004-0210 is a memory-safety flaw (CWE-120, buffer overflow) in the POSIX subsystem of Microsoft Windows that allows a user who is already logged on to elevate privileges and take complete control of the affected system. It is triggered by a local, logged-on user sending crafted input to the POSIX subsystem, so exploitation requires the ability to execute code on the host rather than network access. A successful attacker gains SYSTEM-level control, fully compromising the machine and typically using the escalation to turn a limited account into full administrative access as part of a broader intrusion or ransomware chain. The flaw affects Windows versions that shipped the vulnerable POSIX subsystem — historically Windows NT 4.0, Windows 2000, and Windows XP per Microsoft's MS04-020 bulletin — while CISA lists the affected product broadly as 'Microsoft Windows'. CISA added the vulnerability to the Known Exploited Vulnerabilities catalog on 2022-03-03, confirming exploitation in the wild (ransomware use unknown); EPSS estimates a 7.2% probability of exploitation within 30 days (94th percentile), no public proof-of-concept is known, and CVSS has not yet been scored.

Do: Apply Microsoft's POSIX subsystem security update (MS04-020) per vendor instructions on any Windows NT 4.0, Windows 2000, or Windows XP system still in service, prioritizing multi-user hosts such as terminal servers, shared workstations, and jump boxes where untrusted users can log on locally. Federal agencies must remediate per CISA's KEV/BOD 22-01 timelines; where legacy systems cannot be patched, restrict interactive logon to trusted users, disable or remove the POSIX subsystem if unused, and monitor for signs of local SYSTEM-level escalation.