CVE-2019-1405
Published: 12 November 2019
Summary
CVE-2019-1405 is a high-severity Improper Privilege Management (CWE-269) vulnerability in Microsoft Windows 10 1709. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 1.9% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and AC-6 (Least Privilege).
Deeper analysis
The vulnerability is an elevation of privilege issue in the Windows Universal Plug and Play (UPnP) service that stems from improper allowance of COM object creation. It affects Windows systems running the UPnP service and carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, along with CWE-269 classification for improper privilege management.
A local attacker with low privileges can exploit the flaw to create arbitrary COM objects through the UPnP service, resulting in full elevation to higher privileges that grant complete control over confidentiality, integrity, and availability on the affected system.
Microsoft's security advisory and associated patches address the issue by correcting the COM object creation logic in the UPnP service; administrators should apply the updates referenced in the MSRC guidance. The vulnerability is also tracked in CISA's catalog of known exploited vulnerabilities, and public exploit code has been published demonstrating local privilege escalation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2019-9962
Vulnerability details
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
- CWE(s)
- KEV Date Added
- 15 March 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly enforces access policy on COM object creation requests to the UPnP service, blocking the unauthorized elevation path described in the CVE.
Limits privileges granted to the UPnP service and callers so that low-privileged users cannot obtain arbitrary COM objects leading to full system control.
Requires prompt application of the vendor patch that corrects the flawed COM object creation logic in the UPnP service.