CVE-2015-1701highunder attackransomware

CVE-2015-1701

Published · Updated

Follow this CVE+ Monitor Win32k

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has a working public exploit and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 56%
from disclosure to weapon21 days
Published on NVDApr 21
1st PoC+21d
metasploit+21d
CISA KEV+2508d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateAPT28🇷🇺 MITRE ATT&CK
Action required by CISAfederal deadline: 2022-03-24

Apply updates per vendor instructions.

In short

A flaw in Windows kernel drivers allows a local user to run a specially crafted program that grants them admin-level access to the system. This was actively exploited by attackers in April 2015.

Technical detail

Win32k.sys kernel-mode driver contains an elevation of privilege vulnerability exploitable by local authenticated users through a crafted application. Pre-condition requires local code execution capability; successful exploitation grants SYSTEM-level privileges, enabling complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.