CVE-2011-2005highunder attack

CVE-2011-2005

Published · Updated

Follow this CVE+ Monitor Ancillary Function Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

98Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 32%
from disclosure to weapon49 days
Published on NVDOct 12
1st PoC+49d
metasploit+49d
CISA KEV+3820d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateFIN6 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-04-18

Apply updates per vendor instructions.

In short

A flaw in Windows' Ancillary Function Driver allows a local user to run malicious code with system-level privileges by sending specially crafted commands. This bypasses Windows security protections.

Technical detail

The afd.sys kernel driver in Windows XP SP2/SP3 and Server 2003 SP2 fails to properly validate user-mode input before processing it in kernel mode, enabling a local attacker to escalate privileges and execute arbitrary code with kernel-level access via a crafted application.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application, aka "Ancillary Function Driver Elevation of Privilege Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.