{"id":"CVE-2007-5633","published":"2007-10-23T17:00:00Z","modified":"2024-08-07T15:39:13Z","title":"Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users…","vendor":null,"product":null,"tier":"core","eol":null,"description":{"text":"Speedfan.sys in Alfredo Milani Comparetti SpeedFan 4.33, when used on Microsoft Windows Vista x64, allows local users to read or write arbitrary MSRs, and gain privileges and load unsigned drivers, via the (1) IOCTL_RDMSR 0x9C402438 and (2) IOCTL_WRMSR 0x9C40243C IOCTLs to \\Device\\speedfan, as demonstrated by an IOCTL_WRMSR action on MSR_LSTAR.","provenance":"source","from":"CVE.org"},"summary":null,"cvss":null,"epss":{"score":0.00935,"percentile":0.60659,"date":"2026-10-28","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2018-03-06","exploitedFirstSeen":"2018-03-06","ransomware":false,"evidence":[{"url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/09133534/The-Slingshot-APT_report_ENG_final.pdf","date":"2018-03-06"},{"url":"https://securelist.com/apt-slingshot/84312/","date":"2018-03-09"},{"url":"https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf","date":"2020-06-18"},{"url":"https://www.rapid7.com/blog/post/2021/12/13/driver-based-attacks-past-and-present/","date":"2021-12-13"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"loldrivers.io","url":"https://otx.alienvault.com/pulse/642db85b19acecf096a02bbf","created":"2023-04-05"},{"name":"oldrivers.io","url":"https://otx.alienvault.com/pulse/642db6f245261b927d9d34ff","created":"2023-04-05"},{"name":"oldrivers.io","url":"https://otx.alienvault.com/pulse/642db6f2d228458ec7b61545","created":"2023-04-05"},{"name":"oldrivers.io","url":"https://otx.alienvault.com/pulse/642db6f045261b927d9d34fe","created":"2023-04-05"},{"name":"oldrivers.io","url":"https://otx.alienvault.com/pulse/642db6efeac79a6d26000ebf","created":"2023-04-05"},{"name":"oldrivers.io","url":"https://otx.alienvault.com/pulse/642db6efc36d875d9cef9aaf","created":"2023-04-05"},{"name":"InvisiMole","url":"https://otx.alienvault.com/pulse/61ebc8f75a3d3c67ccc6f98d","created":"2022-01-22"},{"name":"InvisiMole: The hidden part of the story","url":"https://otx.alienvault.com/pulse/5eeb8b9d068b1ec75b7d7bb3","created":"2020-06-18"},{"name":"The Slingshot APT","url":"https://otx.alienvault.com/pulse/5aa2c9e4b891a06c9ce5267e","created":"2018-03-09"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37298","tags":["vdb-entry","x_refsource_XF"]},{"url":"http://osvdb.org/41842","tags":["vdb-entry","x_refsource_OSVDB"]},{"url":"http://www.reversemode.com/index.php?option=com_content&task=view&id=42&Itemid=1","tags":["x_refsource_MISC"]},{"url":"http://www.securityfocus.com/bid/26123","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://secunia.com/advisories/27312","tags":["third-party-advisory","x_refsource_SECUNIA"]},{"url":"http://www.bugtrack.almico.com/view.php?id=987","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[{"id":"SRC-7b8e8d0c3a78be808510","title":"ESET InvisiMole","publisher":"web-assets.esetstatic.com","url":"https://web-assets.esetstatic.com/wls/2020/06/ESET_InvisiMole.pdf","date":null,"mentions":[{"quote":"WHITE\r\n6.3 Speedfan exploit chain\r\nIn the Speedfan exploit execution chain, InvisiMole uses the Bring Your Own Vulnerable Driver technique\r\nto load the speedfan.sys driver on the compromised system, and then exploit local privilege escalation\r\nvulnerability (CVE-2007-5633) to gain code execution in kernel","start":58812,"end":59118},{"quote":"InvisiMole has exploited CVE-2007-5633 vulnerability in","start":106782,"end":106837}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2007-5605","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2007-5605","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":30681,"url":"https://www.exploit-db.com/exploits/30681","title":"SpeedFan - 'Speedfan.sys' Local Privilege Escalation","type":"local","platform":"windows","date":"2007-10-18","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2007-10-18"},"first":{"date":"2007-10-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/30681"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2007-10-18","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-30681)","url":"https://www.exploit-db.com/exploits/30681","provenance":"source"},{"date":"2007-10-23","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2007-5633","provenance":"source"},{"date":"2018-03-06","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/09133534/The-Slingshot-APT_report_ENG_final.pdf","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":58.3,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3159 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.13,"detail":"percentile 0.6066"},{"name":"Named in threat reports","points":3.87,"detail":"1 report"},{"name":"Public exploit code","points":5.0,"detail":"1 Exploit-DB entry"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}