⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-03-24.

CVE-2015-1701

CWE-2649 documents8 sources
Severity
7.8HIGH
EPSS
90.2%
top 0.41%
CISA KEV
KEVRansomware
Added 2022-03-03
Due 2022-03-24
Exploit
Exploited in wild
Active exploitation observed
Affected products
1
Microsoft Windows 2003 Server
Timeline
PublishedApr 21
KEV addedMar 3
KEV dueMar 24
Latest updateMay 13
CISA Required Action: Apply updates per vendor instructions.

Description

Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a crafted application, as exploited in the wild in April 2015, aka "Win32k Elevation of Privilege Vulnerability."

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages1 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-rq9p-fw9r-ppg4: Win32k↗2022-05-13
▶
CVEList
CVE-2015-1701: Win32k↗2015-04-21
▶
VulnCheck
Microsoft Win32k Privilege Escalation Vulnerability↗2015
▶

💥Exploits & PoCs

2
Exploit-DB
Microsoft Windows - ClientCopyImage Win32k (MS15-051) (Metasploit)↗2015-06-24
▶
Exploit-DB
Microsoft Windows - Local Privilege Escalation (MS15-051)↗2015-05-18
▶

🔍Detection Rules

1
YARA
CVE_2015_1701_Taihou↗
▶

📋Vendor Advisories

1
CISA
Microsoft Win32k Privilege Escalation Vulnerability↗2022-03-03
▶

🕵️Threat Intelligence

1
Threat Intel
APT16
▶