CVE-2019-1405

CVE Database · CVE-2019-1405

CVE-2019-1405

· HIGHAnalyzed

CVSS v3.1

7.8

EPSS

29.95%

Published

Nov 12, 2019

Modified

Oct 29, 2025

CISA Known Exploited Vulnerability

Added: 2022-03-15 · Due: 2022-04-05

Apply updates per vendor instructions.

Public PoC / Exploit (4)

All weaponized →

Exploit-DBMicrosoft UPnP - Local Privilege Elevation (Metasploit)Exploit-DBMicrosoft Windows 10 Build 1803 < 1903 - 'COMahawk' Local Privilege Escalation TrickestTrickest PoC index GitHub PoCapt69/COMahawk★349

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

Affected Products (29)

microsoft · windows_10_1507vulnerable

microsoft · windows_10_1607vulnerable

microsoft · windows_10_1709vulnerable

microsoft · windows_10_1803vulnerable

References (5)

http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html

Third Party AdvisoryVDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405

PatchVendor Advisory

http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html

Third Party AdvisoryVDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405

PatchVendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1405

US Government Resource

KEV Catalog EPSS Scores Vendors All CVEs