CVE-2019-1405

This is a Windows flaw in the UPnP service (a component that can help devices find and talk to each other). In some cases, an attacker can use it to break out of normal user permissions and get higher “control-level” access on the machine—like getting keys to areas of a building they shouldn’t reach.

This matters if you run Microsoft Windows desktop or server versions that are listed as affected for CVE-2019-1405. The risk becomes real when the UPnP service is present and reachable in your environment and an attacker can interact with it (for example, during an intruder’s foothold before they escalate privileges). CISA lists it as used in ransomware campaigns, which increases the likelihood of practical attack attempts.

Attackers have used this weakness in real-world ransomware campaigns, and CISA added it to its Known Exploited Vulnerabilities list. Because exploitation has been observed and public exploits exist, you should treat this as urgent and prioritize patching for any affected Windows systems.

Confirm exposure

• Identify which machines run the affected Windows versions: Windows 7, Windows 8.1, Windows 10, Windows RT 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016.
• For each machine, confirm whether the Windows UPnP service is installed and enabled as part of your current configuration.

Patch / remediate

• Follow Microsoft’s remediation guidance for CVE-2019-1405 (Windows UPnP Service Elevation of Privilege) as provided in the Microsoft security advisory.
• Apply the vendor updates on all affected systems.

If patching is delayed

• Use Microsoft’s CVE-specific guidance to disable or restrict the UPnP service until the updates can be applied.

Validate

• Re-run your patch compliance checks to confirm the update(s) described by Microsoft are installed.
• Confirm that UPnP remains disabled/restricted if that’s part of your interim risk reduction approach.

Timing and KEV

• CISA KEV listing exists for this CVE, with a remediation due date of 2022-04-05—so prioritize completion as soon as possible in your environment.

What to monitor

• During and after changes, watch for unusual authentication/privilege changes and any signs of lateral movement or ransomware staging (especially on servers and endpoints that have UPnP enabled).

CVE-2019-1405 is an elevation of privilege vulnerability (CWE-269) involving the Windows UPnP service improperly allowing COM object creation. This can permit an attacker to escalate from lower privileges to higher privileges on the affected Windows system. The vulnerability is listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, indicating it has been exploited in the real world; KEV entry also notes usage in ransomware campaigns. A public exploit is available, and exploitation maturity is therefore considered practical rather than purely theoretical. A weaponized/public exploit exists, and sustained press attention is reported; however, the primary driver for urgency here is KEV-confirmed real-world exploitation.