CVE-2015-2291highunder attackransomwareCWE-20

CVE-2015-2291

Published · Updated

Follow this CVE+ Monitor Ethernet Diagnostics Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

76Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA, has a public proof of concept and 1 threat group(s) use it.

ssvc Actcvss 7.8epss 16%
from disclosure to weaponsame day
Published on NVDAug 9
1st PoCMar 14
CISA KEV+2011d
Who exploits it — 1

Groups known to exploit this vulnerability (MITRE ATT&CK attribution).

APT / StateScattered Spider MITRE ATT&CK
Action required by CISAfederal deadline: 2023-03-03

Apply updates per vendor instructions.

In short

A flaw in Intel's Windows Ethernet diagnostics driver allows a local attacker to crash the system or run malicious code with the highest system privileges by sending specially crafted commands to the driver.

Technical detail

The IQVW32.sys and IQVW64.sys kernel drivers (versions before 1.3.1.0) fail to properly validate IOCTL input (CWE-20) for commands 0x80862013, 0x8086200B, 0x8086200F, and 0x80862007, enabling local code execution or denial of service with kernel-level privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

(1) IQVW32.sys before 1.3.1.0 and (2) IQVW64.sys before 1.3.1.0 in the Intel Ethernet diagnostics driver for Windows allows local users to cause a denial of service or possibly execute arbitrary code with kernel privileges via a crafted (a) 0x80862013, (b) 0x8086200B, (c) 0x8086200F, or (d) 0x80862007 IOCTL call.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.