{"vulnerability": "cve-2021-3544", "sightings": [{"uuid": "4f3db63e-2ad8-4634-af31-bbcaf72e84a8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35448", "type": "seen", "source": "MISP/03fc8db8-c12a-4974-9b1a-d1c0b8f39252", "content": "", "creation_timestamp": "2024-11-14T06:09:25.000000Z"}, {"uuid": "2d6b6c20-d954-477e-9aba-e0ca97853bd4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35448", "type": "exploited", "source": "https://www.exploit-db.com/exploits/50047", "content": "", "creation_timestamp": "2021-06-21T00:00:00.000000Z"}, {"uuid": "3cb112e4-dd0c-4f42-b5f7-b6b10838d5dc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-06T03:13:45.000000Z"}, {"uuid": "961f7bec-c0d5-4649-85ce-8c4f51e4443b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd", "content": "", "creation_timestamp": "2025-02-23T04:10:39.000000Z"}, {"uuid": "07774648-f003-4cae-9880-b243bc42e356", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/lexmark_driver_privesc.rb", "content": "", "creation_timestamp": "2021-08-11T20:12:50.000000Z"}, {"uuid": "79c78060-c97c-4901-9fb3-de5f8ecadcaf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3544", "type": "seen", "source": "https://bsky.app/profile/beikokucyber.bsky.social/post/3lvw5lscqgo2g", "content": "", "creation_timestamp": "2025-08-08T21:02:16.823404Z"}, {"uuid": "735c2d76-3f4c-466b-b7d9-4c738f9c1e05", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35448", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/94", "content": "GitHub\u76d1\u63a7\u6d88\u606f\u63d0\u9192\uff01\uff01\uff01\n\n\u66f4\u65b0\u4e86\uff1aCVE-2021\n\u63cf\u8ff0\uff1aCVE-2021-35448 (Remote Mouse GUI 3.008 - Local Privilege Escalation)\nURL\uff1ahttps://github.com/deathflash1411/CVE-2021-35448", "creation_timestamp": "2021-07-26T07:16:44.000000Z"}, {"uuid": "81dea72f-0543-4854-ab8d-c393506cb5c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3544", "type": "published-proof-of-concept", "source": "Telegram/bsXwCv9vH_95Khs-KOlUGOmnwvxdKBDaN4GoeFlw3yENuFo", "content": "", "creation_timestamp": "2025-08-06T21:00:04.000000Z"}, {"uuid": "53f327b8-dc51-4d4c-bc74-9eeceb26c15b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35448", "type": "seen", "source": "https://t.me/GithubRedTeam/93422", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a RemoteMouse-3.008-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Goultarde\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PowerShell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-14 18:25:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2021-35448 based on https://www.exploit-db.com/exploits/49601\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-16T12:00:06.734173Z"}, {"uuid": "ea3c69a4-7aa2-4beb-83e3-b0578433c982", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35448", "type": "published-proof-of-concept", "source": "https://t.me/GithubRedTeam/93422", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #RCE #CVE #POC\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a RemoteMouse-3.008-RCE\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a Goultarde\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a PowerShell\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-07-14 18:25:35\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPOC for CVE-2021-35448 based on https://www.exploit-db.com/exploits/49601\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "creation_timestamp": "2026-07-17T00:00:50.749033Z"}, {"uuid": "55c14d42-ee50-49f4-9c25-e8c3bd410ed4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-01T20:02:22.410305Z"}, {"uuid": "424bf0b7-7f82-42cd-948a-821566486ab1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:20.411799Z"}, {"uuid": "77cd49b2-c30d-4cb7-bc2a-ec5e7a1d9b9f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/25171", "content": "Kali Linux Tutorials\nConcealed Position : Bring Your Own Print Driver Privilege Escalation Tool\n\nConcealed Position is a local privilege escalation attack against Windows using the concept of \u201cBring Your Own Vulnerability\u201d. Specifically, Concealed Position (CP) uses the as designed\u00a0package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available\n\nConcealed Position offers four exploits \u2013 all with equally dumb names:\n\n* ACIDDAMAGE \u2013\u00a0CVE-2021-35449\u00a0\u2013 Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE \u2013\u00a0CVE-2021-38085\u00a0\u2013 Canon TR150 Print Driver LPE\n* POISONDAMAGE \u2013\u00a0CVE-2019-19363\u00a0\u2013 Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE \u2013\u00a0CVE-2020-1300\u00a0\u2013 Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver\u2019s certificate \u2013 something that is not(?) historically done. But Which Exploit Should I Use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMAGE doesn\u2019t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I\u2019d leave the exploit in my evil server\u2026 as confusing as that may be. Is This A Windows Vulnerability?\n\nArguably, yes. The driver store is a\u00a0\u201ctrusted collection of \u2026 third-party driver packages\u201d\u00a0that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.\n\nMicrosoft seemed to agree when they issued\u00a0CVE-2021-34481.\n\nAlthough\u2026 it\u2019s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn\u2019t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?\n\nAt least Windows 8.1 and above. How Do I Use These Tools?\n\nSimple! So simple there will be many paragraphs to describe it! CP Server\n\nFirst, let\u2019s look at cp_server\u2019s command line options:\n\nC:\\Users\\albinolobster\\concealed_position\\build\\x64\\Release\\bin>cp_server.exe\n_ \n| || || | | || || || _ || | | || |\n| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||\n_ _\n| || || || | | || | | || | | |\n| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |\n| || || || || | | | | | | || || _ |\n| | | | | || | | | | | | || | | |\n|| |||||| || || |_||| || server!\nCLI options:\n-h, \u2013help Display the help message\n-e, \u2013exploit arg The exploit to use\n-c, \u2013cabs arg (=.\\cab_files) The location of the cabinet files\nExploits available:\nACIDDAMAGE\nPOISONDAMAGE[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:49.604976Z"}, {"uuid": "7567b9af-de5c-4c99-9c12-5799169fde23", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-35449", "type": "seen", "source": "https://t.me/hacking_Attack/24066", "content": "KitPloit - PenTest Tools!\nConcealed Position - Bring Your Own Print Driver Privilege Escalation Tool\n\n\nhttps://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg \nConcealed Position is a local privilege escalation attack against Windows using the concept of \"Bring Your Own Vulnerability\". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.\nWhat exploits are available\n\nConcealed Position offers four exploits - all with equally dumb names:\n\n* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE\n* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE\n* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE\n* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE\n\nThe exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.\n\nBut which exploit should I use?!\n\nProbably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.\n\nHow does it work?\n\nConcealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:\n\nStep 1: Stage the driver in the driver store\nclient to server: GetPrinterDriver\nserver to client: Response with driver\n\nStage 2: Install the driver from the driver store\nclient: InstallPrinterDriverFromPackage\n\nStage 3: Add a local printer (exploitation stage)\nclient: Add printer\n\nIt is important to note that SLASHINGDAMA[...]", "creation_timestamp": "2026-09-02T01:02:51.069576Z"}]}