{"id":"CVE-2019-1405","published":"2019-11-12T19:15:13Z","modified":"2026-08-12T05:17:24Z","title":"Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability","vendor":"Microsoft","product":"Windows","tier":"core","eol":null,"description":{"text":"An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.","provenance":"source","from":"NVD"},"summary":{"text":"The Windows Universal Plug and Play (UPnP) service in Microsoft Windows improperly allows COM object creation, which results in an elevation of privilege flaw. An attacker with local access and low-privileged credentials, requiring no user interaction, can exploit it to gain elevated privileges on the affected system.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:59:19Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.30168,"percentile":0.98212,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-03-15","dueDate":"2022-04-05","ransomware":true,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2019-1405","provenance":"source"},"vulncheckKev":{"dateAdded":"2020-03-27","exploitedFirstSeen":"2020-03-27","ransomware":true,"evidence":[{"url":"https://www.group-ib.com/media/silence_ta505_attacks_in_europe/","date":"2020-03-27"},{"url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0603.pdf","date":"2020-06-03"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-03-15"},{"url":"https://www.tenable.com/blog/contileaks-chats-reveal-over-30-vulnerabilities-used-by-conti-ransomware-affiliates","date":"2022-03-24"},{"url":"https://www.securin.io/articles/all-about-conti-ransomware/","date":"2022-06-29"},{"url":"https://asec.ahnlab.com/en/38156/","date":"2022-09-01"},{"url":"https://go.group-ib.com/hubfs/report/protected/group-ib-opera1er-full-threat-research-2022-en.pdf","date":"2022-11-03"},{"url":"https://asec.ahnlab.com/en/56236/","date":"2023-08-22"}],"evidenceTotal":8,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-269","name":"Improper Privilege Management"}],"references":[{"url":"http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405","tags":["Patch","Vendor Advisory"]},{"url":"http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405","tags":["Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1405","tags":["US Government Resource"]}],"techniques":[{"id":"T1068","name":"Exploitation for Privilege Escalation","tactics":["privilege-escalation"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Local privilege escalation via UPnP service flaw","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"elevation of privilege vulnerability exists when the Windows Universal Plug and Play","start":3,"end":87}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1559","name":"Inter-Process Communication","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Abuses COM object creation for execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"improperly allows COM object creation","start":103,"end":140}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2019-9962","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9962","exploited":true,"exploitedSince":"2022-03-15","provenance":"source"},"exploits":[{"id":47684,"url":"https://www.exploit-db.com/exploits/47684","title":"Microsoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation","type":"local","platform":"windows","date":"2019-11-14","verified":false,"provenance":"source"},{"id":47805,"url":"https://www.exploit-db.com/exploits/47805","title":"Microsoft UPnP - Local Privilege Elevation (Metasploit)","type":"local","platform":"windows","date":"2019-12-30","verified":true,"provenance":"source"},{"id":47805,"url":"https://www.exploit-db.com/exploits/47805","title":"Microsoft UPnP - Local Privilege Elevation (Metasploit)","type":"local","platform":"windows","date":"2019-12-30","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-11-14"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-11-13","earliestUrl":"https://github.com/apt69/COMahawk","repos":[{"name":"apt69/COMahawk","url":"https://github.com/apt69/COMahawk","stars":345,"created":"2019-11-13"}]},"metasploit":[{"name":"Microsoft UPnP Local Privilege Elevation Vulnerability","module":"exploit/windows/local/comahawk","type":"exploit","disclosureDate":"2019-11-12","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/comahawk.rb"}],"first":{"date":"2019-11-12","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/comahawk.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html"],"flow":[{"stage":"exploitation","techniques":["T1068"],"provenance":"ai"},{"stage":"primary","techniques":["T1559"],"provenance":"ai"}],"timeline":[{"date":"2019-11-12","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2019-1405","provenance":"source"},{"date":"2019-11-12","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2019-11-13, Exploit-DB 2019-11-14","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/comahawk.rb","provenance":"source"},{"date":"2020-03-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.group-ib.com/media/silence_ta505_attacks_in_europe/","provenance":"source"},{"date":"2022-03-15","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-03-15","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-9962","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":854},"priority":{"score":78.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 2407 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.64,"detail":"percentile 0.9821"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 Exploit-DB entries; 1 NVD exploit link; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-class-microsoft-windows-cwe-269"}}