CVE-2021-1734: 
vulnerability analysis and mitigation

Windows Remote Procedure Call Information Disclosure Vulnerability (CVE-2021-1734) was disclosed on February 9, 2021. This vulnerability affects multiple versions of Microsoft Windows including Windows 10, Windows Server 2012, Windows Server 2016, and Windows Server 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating network accessibility with no privileges or user interaction required. The CVSS v2.0 base score is 5.0 (MEDIUM) with vector (AV:N/AC:L/Au:N/C:P/I:N/A:N) (NVD).

This vulnerability could allow an attacker to obtain sensitive information through the Windows Remote Procedure Call service. The vulnerability specifically impacts information disclosure, with no impact on system integrity or availability (NVD).

The vulnerability is network accessible and requires no privileges or user interaction to exploit, making it relatively straightforward to target. However, specific details about exploitation in the wild are not available in the provided sources.

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB4601315, KB4601318, KB4601319, KB4601331, KB4601345, KB4601349, KB4601354, and KB4601357 for affected Windows versions (Rapid7).