CVE-2019-1405

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.

Affected

Microsoft · Windows · Windows Server · Windows 10 Version 1903 for 32-bit Systems · Windows 10 Version 1903 for x64-based Systems · Windows 10 Version 1903 for ARM64-based Systems · Windows Server, version 1903 (Server Core installation)

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C

EPSS

30.17% chance of exploitation in the next 30 days, 98th percentile

CISA KEV

added 2022-03-15, used in ransomware campaigns

Published

2019-11-12

Updated

2026-08-12

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/windows/local/comahawk.rb

ExploitDB entries (2)

• https://www.exploit-db.com/exploits/47805
• https://www.exploit-db.com/exploits/47684

Security advisories

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1405
• http://packetstormsecurity.com/files/155723/Microsoft-UPnP-Local-Privilege-Elevation.html

References

• CVE Record
• NVD entry