{"id":"CVE-2002-0367","published":"2002-06-25T04:00:00Z","modified":"2026-06-16T21:57:17Z","title":"Microsoft Windows Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"smss.exe debugging subsystem in Windows NT and Windows 2000 does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges by duplicating a handle to a privileged process, as demonstrated by DebPloit.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in the smss.exe debugging subsystem of Microsoft Windows NT and Windows 2000, which fails to properly authenticate programs connecting to other programs. An attacker with local access and low privileges, requiring no user interaction, can duplicate a handle to a privileged process to gain administrator or SYSTEM privileges.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:11:30Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.04919,"percentile":0.92085,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2002-0367","provenance":"source"},"vulncheckKev":{"dateAdded":"2002-03-13","exploitedFirstSeen":"2002-03-13","ransomware":false,"evidence":[{"url":"https://www.exploit-db.com/exploits/21344","date":"2002-03-13"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-03"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"http://marc.info/?l=ntbugtraq&m=101614320402695&w=2","tags":["Mailing List"]},{"url":"http://www.iss.net/security_center/static/8462.php","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/262074","tags":["Broken Link","Exploit","Patch","Third Party Advisory","VDB Entry","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/264441","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/264927","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/4287","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158","tags":["Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76","tags":["Broken Link"]},{"url":"http://marc.info/?l=ntbugtraq&m=101614320402695&w=2","tags":["Mailing List"]},{"url":"http://www.iss.net/security_center/static/8462.php","tags":["Broken Link","Patch","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/262074","tags":["Broken Link","Exploit","Patch","Third Party Advisory","VDB Entry","Vendor Advisory"]},{"url":"http://www.securityfocus.com/archive/1/264441","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/264927","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/4287","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2002/ms02-024","tags":["Patch","Vendor Advisory"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A158","tags":["Broken Link"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A76","tags":["Broken Link"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2002-0367","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: local privilege escalation exploit","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows local users to gain administrator or SYSTEM privileges","start":138,"end":199}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1134","name":"Access Token Manipulation","tactics":["privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: handle duplication yields privileged token access","mappingType":"primary_impact","evidence":[{"from":"description","quote":"does not properly authenticate programs that connect to other programs","start":60,"end":130}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2002-0364","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-0364","exploited":true,"exploitedSince":"2022-03-03","provenance":"source"},"exploits":[{"id":21344,"url":"https://www.exploit-db.com/exploits/21344","title":"Microsoft Windows NT 4.0/2000 - Process Handle Local Privilege Escalation","type":"local","platform":"windows","date":"2002-03-13","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2002-03-13"},"first":{"date":"2002-03-13","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/21344"},"provenance":"source"},"exploitRefs":["http://www.securityfocus.com/archive/1/262074"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1134"],"provenance":"ai"}],"timeline":[{"date":"2002-03-13","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-21344)","url":"https://www.exploit-db.com/exploits/21344","provenance":"source"},{"date":"2002-03-13","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.exploit-db.com/exploits/21344","provenance":"source"},{"date":"2002-06-25","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2002-0367","provenance":"source"},{"date":"2022-03-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2002-0364","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":7191},"priority":{"score":66.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 8996 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.42,"detail":"percentile 0.9208"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-269"}}