Windows Update Medic Service Elevation of Privilege Vulnerability (CVE-2021-36948) Analysis and Mitigation Guide

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-36948) is a local privilege escalation (LPE) vulnerability in the Windows Update Medic Service (WaaSMedicSvc). WaaSMedicSvc is designed to repair and protect Windows Update components and runs under the highly privileged 'NT AUTHORITY\SYSTEM' account. The root cause lies in the improper validation of resources, file paths, or registry keys handled by the service, allowing a local attacker to manipulate these inputs to hijack the service execution flow.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first gain local access to the target system with standard user privileges. The attacker then manipulates specific symbolic links, registry entries, or DLL paths that WaaSMedicSvc accesses during its routine operations. When the service is triggered, it processes the manipulated resources under the SYSTEM context, resulting in the execution of the attacker's malicious payload with elevated privileges. This vulnerability has been actively exploited in the wild and is listed in the CISA KEV catalog.

3. Infrastructure & Business Impact

Successful exploitation allows an attacker to bypass local security boundaries and gain full administrative control over the endpoint or server. In an enterprise environment, this can be leveraged as a stepping stone for lateral movement, credential dumping (e.g., LSASS), ransomware deployment, and establishing persistent access within the Active Directory domain.