7.8

CVE-2019-1405

Warnung
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version - HwPlatform x64
Microsoft ≫ Windows 10 1507 Version - HwPlatform x86
Microsoft ≫ Windows 10 1607 Version - HwPlatform x64
Microsoft ≫ Windows 10 1607 Version - HwPlatform x86
Microsoft ≫ Windows 10 1709 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1709 Version - HwPlatform x64
Microsoft ≫ Windows 10 1709 Version - HwPlatform x86
Microsoft ≫ Windows 10 1803 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1803 Version - HwPlatform x64
Microsoft ≫ Windows 10 1803 Version - HwPlatform x86
Microsoft ≫ Windows 10 1809 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1809 Version - HwPlatform x64
Microsoft ≫ Windows 10 1809 Version - HwPlatform x86
Microsoft ≫ Windows 10 1903 Version - HwPlatform arm64
Microsoft ≫ Windows 10 1903 Version - HwPlatform x64
Microsoft ≫ Windows 10 1903 Version - HwPlatform x86
Microsoft ≫ Windows 7 Version - Update sp1 HwPlatform x64
Microsoft ≫ Windows 7 Version - Update sp1 HwPlatform x86
Microsoft ≫ Windows 8.1 Version - HwPlatform x86
Microsoft ≫ Windows Rt 8.1 Version -
Microsoft ≫ Windows Server 1803 Version - HwPlatform x64
Microsoft ≫ Windows Server 1903 Version - HwPlatform x64
Microsoft ≫ Windows Server 2008 Version - Update sp2
Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform itanium
Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64

15.03.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

Schwachstelle

A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 29.95% 0.98
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NIST 7.2 3.9 10
AV:L/AC:L/Au:N/C:C/I:C/A:C
CISA-ADP 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-269 Improper Privilege Management

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html
Third Party Advisory
VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405
Patch
Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1405
US Government Resource