Windows UPnP Service COM Object Creation Local Privilege Escalation (CVE-2019-1405) Technical Analysis and Hardening Guide
Executive & SecOps Summary
SECOPS ASSESSMENTWindows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 with active UPnP services
A local authenticated attacker can exploit improper COM object instantiation to execute arbitrary code with NT AUTHORITY\SYSTEM privileges
Apply the official Microsoft security updates immediately, or disable the UPnP Device Host service as a temporary workaround
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Applying the official cumulative security updates from Microsoft is the primary remediation path. Use the following PowerShell commands to check and install the required security updates.
# Install and run Windows Update module to apply missing security patches
Install-Module PSWindowsUpdate -Force -SkipPublisherCheck
Get-WindowsUpdate -KBArticleID 'KB4525237', 'KB4525233', 'KB4525235' -Install -AcceptAll -AutoReboot2. Temporary Workaround & Hardening Configuration
If patching cannot be immediately scheduled, disable the UPnP Device Host and SSDP Discovery services to eliminate the attack vector.
# Stop and disable the UPnP Device Host service
Stop-Service -Name 'upnphost' -Force -ErrorAction SilentlyContinue
Set-Service -Name 'upnphost' -StartupType Disabled
# Stop and disable the SSDP Discovery service (dependency)
Stop-Service -Name 'SSDPSRV' -Force -ErrorAction SilentlyContinue
Set-Service -Name 'SSDPSRV' -StartupType Disabled3. Log Audit & IoC Verification Commands
Audit the system event logs to detect potential exploitation attempts or anomalous process creation initiated by the UPnP service host.
# Query Security Event Log for anomalous child processes spawned by svchost hosting UPnP
Get-WinEvent -FilterHashtable @{
LogName='Security';
Id=4688
} -ErrorAction SilentlyContinue | Where-Object {
$_.Properties.Value -like '*upnphost*'
} | Format-Table TimeCreated, @{N='NewProcess';E={$_.Properties.Value}}, @{N='ParentProcess';E={$_.Properties.Value}}Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot
Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2019-1405) is a privilege escalation flaw in the Windows Universal Plug and Play (UPnP) service, stemming from improper access control during COM (Component Object Model) object creation (CWE-269). The UPnP service runs under the highly privileged NT AUTHORITY\SYSTEM context to manage network device discovery. However, a design flaw in its COM interface allows low-privileged local users to force the service to instantiate arbitrary COM objects without proper security descriptor validation, leading to unauthorized privilege elevation.
2. Exploitation Mechanics & Attack Scenario
To exploit this vulnerability, an attacker must first gain local execution capabilities on the target system with low-privilege access. The attacker then sends a crafted Inter-Process Communication (IPC) request to the UPnP Device Host service (upnphost), specifying a malicious Class ID (CLSID) pointing to an attacker-controlled DLL or executable. Because the UPnP service fails to impersonate the caller or restrict COM activation, it loads and executes the specified payload under the SYSTEM context, granting the attacker full administrative control over the host.
3. Infrastructure & Business Impact
As a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2019-1405 has been actively leveraged by threat actors in real-world campaigns. In an enterprise environment, this vulnerability is highly valuable for lateral movement and local privilege escalation (LPE) after an initial foothold is established. Successful exploitation allows attackers to bypass endpoint security controls, deploy ransomware, dump credentials, and compromise the entire Active Directory domain.
Official Vendor Advisories & References
An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'.
Frequently Asked SecOps Questions (CVE-2019-1405)
FAQQ1. How critical is CVE-2019-1405 and is it actively exploited in the wild?
CVE-2019-1405 is rated CVSS 7.8 (HIGH) with a 30-day EPSS exploitation probability of 30.2%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2019-1405?
Primary impacted vendors include microsoft across windows, windows_server. Scope summary: Windows 7, 8.1, 10, and Windows Server 2008, 2012, 2016, 2019 prior to the November 2019 security patch cycle
Q3. What temporary mitigations or workarounds exist for CVE-2019-1405 before patching?
[Mitigation] Apply the official Microsoft security updates immediately, or disable the UPnP Device Host service as a temporary workaround Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2019-1405
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (microsoft)
View Category →Windows IKE Extension Double Free Remote Code Execution Vulnerability (CVE-2026-33824)
[Affected Scope] Internet Key Exchange (IKE) Extension service running on Microsoft Windows and Windows Server operating systems
Windows Remote Access Connection Manager (RasMan) Null Pointer Dereference Local DoS Vulnerability (CVE-2026-21525) Technical Advisory
[Affected Scope] Windows and Windows Server operating systems utilizing the Windows Remote Access Connection Manager (RasMan) service.
Windows ALPC Heap-Based Buffer Overflow Privilege Escalation Vulnerability (CVE-2026-85880) Security Advisory
[Affected Scope] Locally authenticated users across Microsoft Windows operating systems
Windows Update Stack Privilege Escalation Vulnerability via Link Following (CVE-2026-81963) Technical Advisory
[Affected Scope] Microsoft Windows operating systems utilizing the Windows Update Stack
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.