Privilege Escalation in Windows smss.exe (CVE‑2002‑0367) Allows Local Users to Attain SYSTEM Rights
What It Is — The smss.exe debugging subsystem fails to authenticate programs that connect to other programs, letting a local user elevate to Administrator or SYSTEM privileges.
Exploitability — Public exploit code exists; the vulnerability scores a high CVSS (≈7.5) and can be triggered without special conditions on any vulnerable Windows installation.
Affected Products — Microsoft Windows operating systems (all supported versions at the time of the advisory).
Why It Matters for Trust & Control Assurance
- Demonstrates the critical need for privileged‑access management and continuous monitoring of privileged account activity.
- Highlights the audit‑ready value of timely patch management as evidence that known weaknesses are being remediated.
- Shows that legacy components can create control gaps; maintaining defensible evidence of hardening mitigates this risk.
Recommended Actions
- Deploy Microsoft’s latest security updates that address CVE‑2002‑0367.
- Disable the
smss.exedebugging interface where it is not required. - Enforce least‑privilege policies and monitor for anomalous privileged‑process launches.
- Capture patch‑status evidence in your control repository to support audit readiness.
Source: CISA KEV – CVE‑2002‑0367