Skip to main content

Windows 10 Zero-day Vulnerability

A vulnerability in Windows 10 and Windows 10 S allows an attacker to bypass the Window’s Device Guard and run arbitrary code on a user’s system.
Threat ID:
CC-2294
Category:
Threat Severity:
Low
Threat Vector:
Published:
26 April 2018 12:00 AM
Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

A vulnerability in Windows 10 and Windows 10 S allows an attacker to bypass the Window’s Device Guard and run arbitrary code on a user’s system.

Affected platforms

The following platforms are known to be affected:

Windows 10

  • Microsoft Windows 10
  • Microsoft Windows 10 S

Threat details

For an attacker to successfully exploit the vulnerability they will need to gain physical access to the user’s device. The device must have admin privileges already or the attacker will need to escalate the privileges on the user’s device.

Once an attacker has modified the Windows registry keys they can run untrusted .NET code which allows them to run further arbitrary code of their choice.

Remediation steps

Type Step
  • Currently there isn't a patch available for the vulnerability.
  • Ensure all day-to-day computer activities such as email and internet are performed using non-administrative accounts.
  • A robust program of education and awareness of physical security training is delivered to users to ensure that computers are locked when the user isn’t at their device.
  • Only allow authorised personnel to access user’s devices.

Last edited: 17 February 2020 12:57 pm