Actively exploited in the wild
Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability
Microsoft - Windows · Listed in the CISA KEV since 2022-03-15. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2019-1405
HighCVSS 7.8KEVExploitation Probability (EPSS)
Very high risk98th percentile - higher than 98% of all known CVEs
Summary
Elevation of privilege vulnerability in Windows Universal Plug and Play (UPnP) service due to improper allowance of COM object creation.
Risk Assessment
Potential for privilege escalation on the system.
Recommendation
Apply security updates from Microsoft.
Original NVD description (English source)
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.