VULNERABILITY INTELLIGENCE

CVE-2019-1405

CVSS score7.8 HIGH

EPSS probability30.17%

CISA KEVKnown exploited vulnerability

Published2019-11-12

Last modified2026-08-12

CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

Vendor / product: Microsoft / Windows

Description

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

Weakness classification

CWE-269: Improper Privilege Management

Primary references

secure@microsoft.com — Third Party Advisory, VDB Entry
secure@microsoft.com — Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108 — Third Party Advisory, VDB Entry
af854a3a-2127-422b-91ae-364da2661108 — Patch, Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0 — US Government Resource