CVE-2014-4076observed exploitation

CVE-2014-4076

65Vexday Risk Score

Patch now. It exploitation observed by VulnCheck, has a working public exploit and 1 threat group(s) use it.

ssvc Actepss 23%

from disclosure to weapon79 days

Published on NVDNov 11

1st PoC+79d

metasploitNov 11

VulnCheck+632d

exploitation probability

23%top 2% of all CVEs

observed exploitation

yesVulnCheck

1 group(s)6 public exploit(s)

Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT28🇷🇺

Microsoft Windows Server 2003 SP2 allows local users to gain privileges via a crafted IOCTL call to (1) tcpip.sys or (2) tcpip6.sys, aka "TCP/IP Elevation of Privilege Vulnerability."

Affected products

n/a · n/a

public PoCs found — 6

exploitdbwww.exploit-db.com/exploits/35936unverified exploitdbwww.exploit-db.com/exploits/37755unverified githubgithub.com/fungoshacks/CVE-2014-4076★ 0 cve_referencewww.exploit-db.com/exploits/37755/unverified cve_referencewww.exploit-db.com/exploits/35936unverified vulncheckvulncheck.com/xdb/ea8c478978c8unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-070 https://www.exploit-db.com/exploits/37755/http://www.exploit-db.com/exploits/35936 http://www.osvdb.org/114532 http://www.securityfocus.com/bid/70976