CVE-2019-1405

What is the Windows UPnP Service?

Universal Plug and Play (UPnP) lets devices and applications on a local network automatically discover each other and configure port forwarding without manual setup. On Windows, the UPnP Device Host service runs with elevated privileges so it can create network sockets and registry entries needed for device/service advertisement.

Overview

CVE-2019-1405 is a local privilege escalation vulnerability in the Windows UPnP service. The service improperly allows creation of COM objects with more privilege than is warranted, so a local, low-privileged process can instantiate a COM object through the UPnP service and have it execute in an elevated security context. Microsoft rated the issue Important, with a CVSS 3.1 base score of 7.8. It requires local access and low privileges to start, but no user interaction.

Technical Details

The flaw stems from insufficiently restrictive COM object activation permissions exposed by the UPnP service. Normally, COM security descriptors restrict which callers may instantiate and interact with a given class; here, a lower-integrity or standard-user process is able to reach a COM object that then executes code with the elevated privileges of the UPnP host service. This is a textbook privilege-management flaw (improper access control on an inter-process communication mechanism), enabling privilege escalation from standard user to SYSTEM without needing to corrupt memory or exploit a parsing bug.

Discovery

The vulnerability was patched as part of Microsoft's November 2019 Patch Tuesday release; Microsoft's advisory does not attribute discovery to a named external researcher, suggesting it was found through Microsoft's internal security review process.

Exploitation Context

CVE-2019-1405 was added to the CISA KEV catalog in March 2022 and is flagged as used in ransomware campaigns. As with most local privilege-escalation bugs, it is valuable to attackers as a second-stage tool: once initial code execution is obtained on a Windows host (through phishing, a remote exploit, or stolen credentials), this flaw provides a path to SYSTEM, enabling ransomware deployment, credential harvesting, and disabling of endpoint defenses.

Remediation

1. Apply the November 2019 Windows cumulative update or any later monthly security rollup, which contains the fix for CVE-2019-1405.
2. Verify patch deployment via Windows Update for Business, WSUS, or a vulnerability scanner.
3. Restrict local logon and remote desktop access to reduce the number of accounts capable of staging a local exploit.
4. Deploy endpoint detection to flag unusual COM object activation chains involving the UPnP host service.
5. Prioritize this patch on internet-facing or high-value hosts given its confirmed use in ransomware intrusions.