CISA Known Exploited Vulnerability

CVE-2019-1405 Ransomware

Microsoft · Windows

Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability

Date added 2022-03-15

BOD 22-01 due date 2022-04-05

CWE —

Ransomware Known

CISA description

A privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.

Apply updates per vendor instructions.

Vulnerability data triggers these controls during assessment and continuous monitoring.